Require password to install anything onto system?

[tgm4883]

Guess what google is written in?

Javascript?

[doas777]

Javascript?

that was my guess.

[CharlesA]

Javascript?

I was thinking html5 with php (but javascript is likely as well)

[toolmania1]

Maybe. I knew it was using flash. Well, if that is the case now, maybe there is another bug. Yikes!

Google has been using HTML5 for a while now hasn't it?

[tgm4883]

Maybe. I knew it was using flash. Well, if that is the case now, maybe there is another bug. Yikes!

I don't think google images has ever used flash

[toolmania1]

Regarding:


"since /home/user/ is writable by your user, installing a package into it would not require a password."


If we cannot require a password then can we change this so that /home/user is not always writable until we want it to be? You guys know what I am getting at. Without knit picking at details, is there anything similar so that the OS can stop any outside installations until I tell it to. I know I am already telling it to. But I want everything brought to my attention is the key. A password would do this on every single thing that was being installed onto a computer. Does this make sense what I am asking?

keep in mind, there isn;t really such a thing as "installing" in the context of which you speak.
yes, anything "installed" via dpkg (apt-get/synaptic/softwarecenter) requires a password, but you do not need to use dpkg to write an executable file to your cache, mark it to allow execution and running it. as such this is not an "installation". in fact, the only reason dpkg requires a password is because teh file permissions in the location it wishes to install the file require root to write. since /home/user/ is writable by your user, installing a package into it would not require a password.

there is an old unix command "install". all it does is copy the executable to the folder specified, and sets the execute bit.

so there really is no differance between writing a file to your disk (temp internet files, cookies, content pages, etc) and installing a program to run from /home/user/

[toolmania1]

Ok. Well, regardless, there was a redirect and something was installed onto my computer.

I don't think google images has ever used flash

[toolmania1]

Ok. I am going with AppArmor later today. Thanks!

I have to agree with the others, apparmor is your best bet.

the rest of your system (everything outside your home) should be safe by default, as only root is allowed write access, and would require sudo/gksu to install, and the installer would have to have the ability to set permissions to enable the execute bit.
that means the only location the browser can write to is within your /home/user directory.

apparmor restricts your browser to only have access to resources it requires to function, and thus limits any potential damage to those specific locations.

in the long run, that is the best you can do. a browser by definition needs the ability to download files from the internet and write them to disk. in the case of executable content (flash/java) it must also be able to execute files it writes.

[tgm4883]

Ok. Well, regardless, there was a redirect and something was installed onto my computer.

"Installed" has a certain connotation, nothing was "Installed" to your system without a password. Downloaded perhaps, but not installed.

You still really haven't given any details about what happened. What was downloaded, did it run, etc. Without any specifics some people might write you off and say you are a troll.

My recommendation:
Install and configure AppArmor and be done with it.

[toolmania1]

Ya, good point. If I am a troll, I am a troll. I realize I did not get the information so that people could check it out. I did not mean to cause any confusion. I did not want to open up my system again to find out. I honestly wasn't the user in front of the pc. When I got home, the pc was turned off. I stuck the Ubuntu cd in and installed from scratch. So, sorry, I don't have more info. I am going to mark this as closed. I don't want to offend anyone. You're right. Thanks everyone for your help. I will learn to make sure and have more information next time. Later!

"Installed" has a certain connotation, nothing was "Installed" to your system without a password. Downloaded perhaps, but not installed.

You still really haven't given any details about what happened. What was downloaded, did it run, etc. Without any specifics some people might write you off and say you are a troll.

My recommendation:
Install and configure AppArmor and be done with it.