Configure Wine to run only one application

Bonxie · Post by **Bonxie** » Fri Jun 11, 2010 9:04 am

I persuaded my friends to convert to Linux, now they want Sketchup!
They are the sort of people who would click on anything and I don't want them to get malware etc.
Is there a way to make Wine run *only* Sketchup and nothing else?

I did try searching for the answer but couldn't find one.
Thanks

James Mckenzie · Post by **James Mckenzie** » Fri Jun 11, 2010 9:11 am

Bonxie <[email protected]> wrote at Jun 11, 2010 7:04 AM

I persuaded my friends to convert to Linux, now they want Sketchup!
They are the sort of people who would click on anything and I don't want them to get
malware etc.

Is there a way to make Wine run *only* Sketchup and nothing else?

No. That is the simple answer. The more complex answer is that, yes you can change the ownership of the .wine directory so that NOTHING can be added/deleted and then point the temporary file directory to somewhere else. This is not as trivial as it seems and is best left as an exercise for the student.

I did try searching for the answer but couldn't find one.

That is because we have discouraged this in the past, but if you read through the forum you will discover that past attempts have failed.

James McKenzie

Bonxie · Post by **Bonxie** » Fri Jun 11, 2010 11:12 am

Thanks, I will have to scratch my head for a while about this.
I'm dealing with folk who can only just copy a file, this could take some time!
If I solve the problem I will get back to you.

James Mckenzie · Post by **James Mckenzie** » Fri Jun 11, 2010 12:13 pm

Bonxie <[email protected]> wrote at Jun 11, 2010 9:12 AM:

Thanks, I will have to scratch my head for a while about this.
I'm dealing with folk who can only just copy a file, this could take some time!
If I solve the problem I will get back to you.

As an (ISC)2 SSCP, I can state that many companies have tried to institute what you want, but the biggest thing you can do is educate. Teach your users to NOT click on that link and to NOT install software unless it comes from your company. Your company should also use AV scanners. ClamAV is available for Linux and is very inexpensive. Also your company might want to look at using imaging to rebuild systems that have been infected with malware, which does exist for Linux and MacOSX, quickly. Again, configuring Wine to support non-installation of software is complex and in some cases bypassable.

As to the regular Wine audience, this topic has been brought up in the past and will be in the future. Please take time to carefully read through the above. Basically, a small dose of prevention (that is preventing people from reaching sites with malware) is a lot easier than correcting (that is rebuilding every system in your enterprise). This has been true for a long time and should be common knowledge among system administrators and system operators.

Very respectfully,

James McKenzie

Martin Gregorie · Post by **Martin Gregorie** » Fri Jun 11, 2010 12:33 pm

On Fri, 2010-06-11 at 09:04 -0500, Bonxie wrote:

I persuaded my friends to convert to Linux, now they want Sketchup!
They are the sort of people who would click on anything and I don't want them to get malware etc.
Is there a way to make Wine run *only* Sketchup and nothing else?

I did try searching for the answer but couldn't find one.

One way would be to install it in a dedicated login on a server. The
setup could be done like this.

1) Create a normal login called 'wineapp'
2) login to wineapp and create a directory called 'bin'
3) Use a text editor to create a script called runwineapp in bin:
==================== start of 'runwineapp' script ======================
#!/bin/bash

#
# Make sure only one user can run the application at a time
#
if [ -f in_use ]
then
echo "Sorry - the application is in use"
echo "Try again later"
exit
else
>in_use
fi

#
# CD to the directory where the application is installed
#
cd '.wine/drive_c/Program files/TheApplication' application

#
# Now run the application
#
wine application.exe

#
# Remove the in use marker
#
cd
rm in_use
exit

==================== end of 'runwineapp' script ======================

4) Make the script executable:

chmod uga+x /home/wineapp/bin/runwineapp

5) Use the user maintenance tool to change the shell to be used on
login from /bin/bash to /home/wineapp/bin/runwineapp

NOTE: If the user maintenance tool won't let you change the shell
use the usermod command line program:
- login as root, use sudo or su
- run the command:

usermod wineapp -s /home/wineapp/bin/runwineapp

6) If you, as application admin, need access as a normal user
to wineapp, you should set up a second user that is the same in
all respects as wineapp (including the user and group IDs) by
using the useradd utility with the -o option, which lets you add
add a user with a duplicate user id.

Now, when the user logs in to wineapp, the application will be run
immediately and the 'in use' marker will be set. When the user exits
from the application the 'in use' marker will be unset and the user will
be logged out, but if you log in as the wineapp admin, you'll get a
normal login desktop.

HTH

Martin

James McKenzie · Post by **James McKenzie** » Fri Jun 11, 2010 10:15 pm

Martin Gregorie wrote:

On Fri, 2010-06-11 at 09:04 -0500, Bonxie wrote:

I persuaded my friends to convert to Linux, now they want Sketchup!
They are the sort of people who would click on anything and I don't want them to get malware etc.
Is there a way to make Wine run *only* Sketchup and nothing else?

I did try searching for the answer but couldn't find one.

One way would be to install it in a dedicated login on a server. The
setup could be done like this.

What happens if he wants more than one user to be able to use the
'application' at one time?

I'll investigate, but the solution should be simple, but the problem is
very complex.

James McKenzie

Martin Gregorie · Post by **Martin Gregorie** » Sat Jun 12, 2010 5:49 am

On Fri, 2010-06-11 at 20:15 -0700, James McKenzie wrote:

Martin Gregorie wrote:
On Fri, 2010-06-11 at 09:04 -0500, Bonxie wrote:

I persuaded my friends to convert to Linux, now they want Sketchup!
They are the sort of people who would click on anything and I don't want them to get malware etc.
Is there a way to make Wine run *only* Sketchup and nothing else?

I did try searching for the answer but couldn't find one.

One way would be to install it in a dedicated login on a server. The
setup could be done like this.

What happens if he wants more than one user to be able to use the
'application' at one time?

There are almost no Windows apps that can handle multiple simultaneous
users. Those that can are designed to be installed on a server or
written explicitly as desktop servers.

Since a Windows desktop box can't be used by more than one user at a
time it follows that the OS will lack file access locks (only Windows
Server has those) and there's no requirement for a normal Windows app to
support more than one user at a time either. All those that can
apparently do so are either servers (e.g. SQL Anywhere) or operate as a
single program with multiple windows (e.g. text editors, Word).

From a fairly quick look at the Google SketchUp! it would appear that

the program is a normal Windows desktop application, so if the OP wants
several friends to use a single copy, he'll have to protect it from
simultaneous access by something like the method I outlined. Otherwise
he'll need multiple installations regardless of whether they are under
separate users on a single Linux box or on separate boxes - and still
need the single user locks to prevent accidental multiple use.

Yes, it is probably possible to finangle things so one install can be
used from a single prefix, but can the program be run that way without
it tripping over itself when more than one user accesses the same
internal structures or on-disk workspace? Only Google would know the
answer to that.

I'll investigate, but the solution should be simple, but the problem is
very complex.

Agreed. My plot was tested with a Wine app before I described it: I have
a copy of XCSoar set up on my Fedora 10 server with both a normal
desktop login and a captive login exactly as described. XCSoar is
specialist navigation software for glider pilots, not in the AppDB: its
something I normally run from a wrapper script from the desktop so it
was straightforward to add a captive login that only runs XCSoar and
logs out as soon at XCSoar exits.

The only change I'd make to the script I posted would be to use zenity
or xmessage rather than echo to tell the user that the app is in use:

zenity --error --text="SketchUp! is being used: try again later"

because this gives a somewhat more user friendly error display than
simply using echo. This works OK with a remote login. I use ssh with X11
forwarding enabled.

Martin

Gert van den Berg · Post by **Gert van den Berg** » Sat Jun 12, 2010 8:15 am

On Sat, Jun 12, 2010 at 12:49, Martin Gregorie <[email protected]> wrote:

There are almost no Windows apps that can handle multiple simultaneous
users. Those that can are designed to be installed on a server or
written explicitly as desktop servers.

Most apps can handle it by using separate HKCU registry and
configuration in a per-user directory.... (And not allowing limited
users write access to shared spaces...)

Since a Windows desktop box can't be used by more than one user at a
time it follows that the OS will lack file access locks (only Windows
Server has those) and there's no requirement for a normal Windows app to
support more than one user at a time either. All those that can
apparently do so are either servers (e.g. SQL Anywhere) or operate as a
single program with multiple windows (e.g. text editors, Word).

Since Windows XP, Fast user switching allow you exactly that....

http://support.microsoft.com/kb/279765 and
http://support.microsoft.com/kb/q294737/ gives some details..

It is not implemented in Wine though... And some old applications
break when used this way (usually those applications are broken under
non-administrator accounts and does things like saving configuration
in INI files under Program Files)

Gert

Bonxie · Post by **Bonxie** » Sat Jun 12, 2010 9:07 am

One way would be to install it in a dedicated login on a server. The
setup could be done like this.

That sounds interesting but I'm busy for the next few days.
I will definitely give it a try next week and post back with the results.