Restricting Wine to not allow standard users install apps

[pospichalales]

Hello,
I configured Wine to not allow standard users installing or running apps. They will be able to run only predefined apps in sudoers file, so they will run apps under different account. I ran these commands, restriction is working but I have smaller problem. One tested app opens but I get error that was not possible to open file LCF.inf, this file is located in same directory as executed exe file. With standard installation there is no problem with running this app.
Could you help me where can be a problem?

Code: Select all

sudo groupadd wine
sudo chgrp wine /usr/bin/wine
sudo chgrp wine /usr/bin/wine64
sudo chgrp wine /usr/bin/winedbg
sudo chmod u=rwx,g=rx,o=r /usr/bin/wine
sudo chmod u=rwx,g=rx,o=r /usr/bin/wine64
sudo chmod u=rwx,g=rx,o=r /usr/bin/winedbg
sudo adduser --disabled-password windows
sudo usermod -aG wine windows

sudo visudo
%domain_users	ALL=(windows) NOPASSWD: /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

User runs these commands:
/usr/bin/xhost +local:windows
sudo -u windows -H /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

[oiaohm]

pospichalales never say only. I was very much a brat when I was young. I found many ways of breaking out of limited applications locks under Windows due to application flaws. Wine will be no exception.

/programy/Terasoft/MATEM/MATEM1.exe is this a full unit path? If its inside /home/windows it will need to be /home/windows/programy/Terasoft/MATEM/MATEM1.exe

/usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe This line it self from security should be in a shell script that drops any extra Arguments passed. Arguments equal bad.

Next you need to define WINEPREFIX so it becomes something like.
WINEPREFIX=[where ever the wineprefix is] /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

Defaults!/path/to/command env_keep=HOME
or
Defaults!/path/to/command env_keep=DISPLAY
in sudo can remove the requirement for /usr/bin/xhost +local:windows

You will find doing a man wine there are a lot of environmental vars that can alter how wine functions. Some of these to prevent users doing unattended things need to be formally set if you use env_keep=HOME.

In fact this is bad in a lot of ways to use the xhost solution. This is also why embeding the long command in a shell script is a good thing.

Now even if this works I still hate it. pospichalales there are a lot of security issues you have just created.

If you are after to save on space you are better off to redirect drive c.

Your uses could run into horible problems.
1) Applications refusing to run twice.
2) Application setting changes being global.

Basic wine prefix layout.
/.wine/*.reg these files are intended to be 1 copy per user.
/.wine/dosdevices These are also one copy per user. Altering c: in here can alter drive_c location to else where.

Basic wine operations. wine-server runs 1 copy per prefix/user. This manages the registry. So this is where hell comes to play. Every user using sudo run run wine as user windows will be sharing the one and only wineserver. So if wineserver crashes everyone will crash in your design.

pospichalales fixing bug 11112 properly would be the way forwards. But this requires the parties needing this feature to either put up developers or money to get it done.
http://bugs.winehq.org/show_bug.cgi?id=11112

pospichalales yes I have giving you advice that might make this work. But I totally don't recommend the path you are on it could break insanely badly. Mostly because wine is not designed to be shared.

[pospichalales]

Application does not write any changes to registry or hard drive.
Application will run only once in time.
/programy/Terasoft/MATEM/MATEM1.exe is full path.
Adding Defaults!/path/to/command env_keep=DISPLAY to sudoers does not remove requirement to run xhost +local:windows

I tried this configuration:

Code: Select all

sudo groupadd wine
sudo chgrp wine /usr/bin/wine
sudo chgrp wine /usr/bin/wine64
sudo chgrp wine /usr/bin/winedbg
sudo chmod u=rwx,g=rx,o=r /usr/bin/wine
sudo chmod u=rwx,g=rx,o=r /usr/bin/wine64
sudo chmod u=rwx,g=rx,o=r /usr/bin/winedbg
sudo adduser --disabled-password windows
sudo usermod -aG wine windows

sudo visudo
%domain_users   ALL=(windows) NOPASSWD: /winescr

If user runs

Code: Select all

sudo -u windows /winescr

and the script contains

Code: Select all

#/bin/bash
/usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

He gets error -

Code: Select all

/home/$user/.wine : Permission denied

, app does not start.

If user runs

Code: Select all

sudo -u windows /winescr

and the script contains

Code: Select all

#/bin/bash
env WINEPREFIX"/home/windows/.wine" /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

He gets these errors but app starts but gives error Cannot find LCF.inf. This file is located in same dir as executable file.

Code: Select all

err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\A35F_hh.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\A35F_hh.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\A35F_hh.0.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-cpl.xml
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-dib.xml
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-dll.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\4137_winhlp32.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\4137_winhlp32.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\4137_winhlp32.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\4137_winhlp32.0.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-htc.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7765_winebrowser.0.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-inf.xml
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-ini.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\application-x-wine-extension-its.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\application-x-wine-extension-its.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\application-x-wine-extension-its.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-its.xml
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-jfif.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7596_iexplore.0.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-lnk.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\application-x-wine-extension-msp.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\application-x-wine-extension-msp.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\application-x-wine-extension-msp.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\application-x-wine-extension-msp.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-msp.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7596_iexplore.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\1E64_notepad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\1CD8_rundll32.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\1CD8_rundll32.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\1CD8_rundll32.0.png"
err:menubuilder:write_freedesktop_mime_type_entry error writing file /home/x1/.local/share/mime/packages/x-wine-extension-vbs.xml
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\256x256\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\2EF4_wordpad.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\16x16\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\32x32\\apps\\7765_winebrowser.0.png"
err:menubuilder:convert_to_native_icon error 0x80070005 creating output file L"Z:\\home\\x1\\.local\\share\\icons\\hicolor\\48x48\\apps\\7765_winebrowser.0.png"
The databases in [/home/x1/.local/share/applications] could not be updated.

And if user runs

Code: Select all

sudo -u windows -H /winescr

and the script contains

Code: Select all

#/bin/bash
/usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

He does not get any error to his terminal, app starts but there is same error that Cannot find LCF.inf

Permissions are correct and if I run app with standard Wine, there is no problem. LCF.inf is in same directory as executable file.

[oiaohm]

env WINEPREFIX"/home/windows/.wine" /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe is
the same as WINEPREFIX"/home/windows/.wine" /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe
The env lead off is optional when using bash.

You found another issue I had forgotten about.

err:menubuilder:convert_to_native_icon error has two work around.
Option to fix one http://wiki.winehq.org/FAQ#head-c847a3d ... d4c7ae042a disable menubuilder.
Option to fix two even longer run command.

Code: Select all

XDG_DATA_HOME=/home/windows/.local/share WINEPREFIX"/home/windows/.wine" /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe

Depending on user to use -H is not going to happen.

Permissions are correct and if I run app with standard Wine, there is no problem. LCF.inf is in same directory as executable file.

Exactly how do you cd to the directory or use WINEPREFIX"/home/windows/.wine" /usr/bin/wine start /Unix /programy/Terasoft/MATEM/MATEM1.exe or by link on the desktop of that user. The LCF.inf issue could be just the application being picky how its run.

Extra options

Code: Select all

#/bin/bash
XDG_DATA_HOME=/home/windows/.local/share WINEPREFIX"/home/windows/.wine" wine start 'Z:\programy\Terasoft\MATEM\MATEM1.exe'   

Would be another possibility.

Code: Select all

#/bin/bash
cd  /programy/Terasoft/MATEM
XDG_DATA_HOME=/home/windows/.local/share WINEPREFIX"/home/windows/.wine" wine MATEM1.exe

Really it a lot of ways I would reinstall the application inside the wine drive c so its all contained in the wineprefix. As you can see without the right wineprefix program is worthless.

Defaults!/path/to/command env_keep=DISPLAY you did not rewrite this did you. /path/to/command is a bit to replace. Defaults!/winescr env_keep=DISPLAY for example.

Lot of my instructions are written in generic forms.

pospichalales you have very bad Linux administration habits. I was never expecting /programy to exist or that you would place an application on root path. /opt and /usr/local exist for reasons. There is zero advantage to installing applications away from wine prefix c: due to the dependence on the wine prefix to run anyhow. If you run root kit hunter programs on what you have done you most likely will get false positives since there are executables where there should not be executables.

https://wiki.debian.org/FilesystemHierarchyStandard
Yes there is a standard where should to place things. This is a big problem I do run into people who not trained how to admin Linux systems and do very bad things.

[pospichalales]

I find a solution. I do not know why but there was a problem with name of account. If I logged as user windows and started that app directly, it did not work too. So I created a different user and this configuration works.

Code: Select all

sudo groupadd wine
sudo chgrp wine /usr/bin/wine
sudo chgrp wine /usr/bin/wine64
sudo chgrp wine /usr/bin/winedbg
sudo chmod u=rwx,g=rx,o=r /usr/bin/wine
sudo chmod u=rwx,g=rx,o=r /usr/bin/wine64
sudo chmod u=rwx,g=rx,o=r /usr/bin/winedbg
sudo adduser --disabled-password x600
sudo usermod -aG wine x600

sudo visudo
%domain_users	ALL=(x600) NOPASSWD: /usr/bin/winescr

sudo -s
mv /home/ubuntu/.wine /home/x600/.wine -iv
chown x600:users /home/x600/.wine -Rvf

sudo nano /usr/bin/winescr
#!/bin/bash
cd /programy/MMM
XDG_DATA_HOME=/home/x600/.local/share WINEPREFIX="/home/x600/.wine wine MATEM1.exe"

sudo chmod +x /usr/bin/winescr

Now the user has to run these commands:

Code: Select all

xhost +local:x600
sudo -u x600 winescr

Xhost command will run automatically with /etc/xdg/autostart

I tried what did you mention and added these lines to /etc/sudoers but it did not work. Then it also did not work even if user run xhost command. I had to delete that lines.

Code: Select all

Defaults!/usr/bin/winescr env_keep=DISPLAY
Defaults!/usr/bin/winescr env_keep=HOME