AlfmanFlatland_Spider,
In the past I’ve solved this by giving the “users” group ownership of “/usr/local” and setting the sticky bit.
There is also sudo magic which could work to limit the scope of the command. This would require setting the target group and command, I think. I’d have to try this to be 100%.
Yeah, I am trying to think of a way for it to work between untrusted users though. Not that the goal is to have malicious users on the system, but as a matter of principal users should be able to efficiently install the same software without trusting each other.
For such a setup to work effectively and be secure, I think the following requirements would need to be met:
1) There needs to be a shared software collection that all the users can publish to
2) Each title published into the software collection needs to be downloaded/installed/verified from an upstream source such as an RPM, DEB, Flatpak, zip, tar.xz, etc. The OS would perform the extraction and authenticate the local installation is a genuine installation, this fact can be communicated to all the users of the system. Naturally the OS can’t vouch for the what the software does (hence the reason to run it in a sandbox), but the OS should be able to precisely vouch for the URL it was downloaded from. Users who trust that URL should trust the software in the collection.
3) Users should have a nice tool to browse/install/customize all software from the shared collection into their own profile. This could mean symlinks, COW FS, bind mounts, or whatever. But the user could not change the software collection by themselves.
4) The system could periodically garbage collect unreferenced software that all users have uninstalled in their profiles.
It seems like it should work in principal, but I imagine there may be gotchas if I actually tried to implement it. One issue is that a lot of software doesn’t come in a ready to install package format from upstream. This is important for the install to be automated. If the install requires manual intervention, then root could still do it, but that kind of defeats the purpose of the idea, which is to install software without root.
CoW filesystems can do this, and it’s supposed to be one of the star features. However, it doesn’t work that well, and it breaks encryption.
I see what you mean about breaking encryption within one file system. This is well outside the scope of anything I had in mind, but for the sake of discussion… I’ve used overlay file systems to overlay readonly squashfs images with tmpfs and it would probably work here too. An overlayfs with COW semantics would let you overlay an encrypted user directory on top of the unencrypted software directory. Then you’d be free to modify the software and have those changes be written into your encrypted profile.
I’m perfectly fine with people installing software into their homedir. I’d rather they do that then installing it on the system. I’m also amazed package managers don’t allow this by default. “dnf –user install tmux” should install tmux into my homedir.
The reason I don’t like this is that it really adds up. Say both my kids install the Hogwarts game, which they both play, into their profile, that’s 85GB per install (not to mention I installed it too). Granted, I cherry picked this game because it’s the largest one we have, but it’s not uncommon for titles to be ~5GB, which is still a lot to duplicate. I don’t consider the duplication of such large resources to be reasonable. Some of the LLM’s I’ve been experimenting with are also in the ~70GB range. Even we want to say just buy larger disks to hold everyone’s files including dups, I would argue that linuxshould offer a better solution. Of course I technically have root on my systems, so I can manually accomplish the sharing I need, but I was thinking of ways we might make shared software work better out of the box without root.
Are you quoting the flatpak docs?
Haha. I can see similarity in scope. Does flatpak solve the multiuser installation problem? If it does, then I did not know about that and I’d be very interesting in learning more about it!