Howto: Install Wine applications for Multiple Users

[rsay]

Background:
Some proprietary windows programs only allow a limited number of installations, making it desirable to install to a common location in the “windows style”, instead of installing separately for each user in the “wine style”. In addition, it may be more efficient for an administrator to install a program once, even if the license allows for unlimited installations. Codeweavers refers to this type of multi-user installation as Shared Global Mode.

Outline of method:
We are going to create a new user, “windows”, that will host the system-wide wine installation. We will then give some of our users permission to run windows programs as the user windows, with wine, on their own desktop, without having to switch accounts or enter passwords.

Estimated time
15-20 minutes

Preparation:
Install wine if you haven't already done so.

sudo apt-get install wine

Run winecfg to test your installation

winecfg

You should see a window pop up with multiple tabs. Applications, Drives, Graphics, Audio, etc.
Close the window

STEP 1. Add a new user without a password.
Pick a user name that doesn't exist on your system

sudo adduser --disabled-password windows

Just hit enter to accept defaults for name, office, phone etc., then answer Y.

STEP 2. Backup /etc/sudoers and use visudo to edit /etc/sudoers

2.1 Backup /etc/sudoers in case something bad happens.

sudo cp /etc/sudoers /etc/sudoers.bak

2.2 Edit /etc/sudoers, but only with visudo.

sudo visudo

Pay careful attention to syntax here. This file isn't very forgiving to editing mistakes.
I used this page to figure out how to edit with vi. I got a log of mileage out of i, o, x, dd and :wq.

If you're a nano user, you can do this:

sudo EDITOR=nano visudo

If you want something more graphical, you can use xedit:

sudo EDITOR=xedit visudo

2.3 In the User alias section, define which users will administrate the computer. (Have root privileges)
This will probably be all the people currently in your admin group

User_Alias ADMIN = ron

2.4 In the User alias section, define which users can run the wine/windows programs.

User_Alias WINDOWS_USERS = kim,ian,mason,collin,ron

* no spaces between the names

2.5 In the command alias section, define which programs the windows user can run

Cmnd_Alias WINDOWS = /usr/bin/wine,/usr/bin/winecfg

2.6 In the defaults section, add the following commands so that we will be able to use our current X windows display

Defaults:WINDOWS_USERS env_reset
Defaults:WINDOWS_USERS env_keep += DISPLAY
Defaults:WINDOWS_USERS env_keep += XAUTHORITY

2.7 Change the line that defines who gets admin privileges
Delete this:

%admin ALL=(ALL) ALL

This gave admin privileges to anybody in the admin group defined in /etc/group

Replace it with this:

ADMIN ALL=(ALL) ALL

This gives admin privileges to anybody listed in the ADMIN alias defined in step 2.3. The difference is subtle but important. Without this change the people in the admin group will always have to supply their password before they can run windows programs.

2.8 Add a line at the bottom that gives WINDOWS_USERS permission to run WINDOWS programs, without a password, as user windows

WINDOWS_USERS ALL = (windows) NOPASSWD: WINDOWS

Here is what my /etc/sudoers file looks like after making these changes:

# User alias specification

# define which users can run the wine/windows programs
User_Alias WINDOWS_USERS = kim,ian,mason,collin,ron

# define which users can administrate (become root)
User_Alias ADMIN = ron

# Cmnd alias specification

# define which commands the WINDOWS_USERS may run
Cmnd_Alias WINDOWS = /usr/bin/wine,/usr/bin/winecfg

# Defaults
Defaults:WINDOWS_USERS env_reset
Defaults:WINDOWS_USERS env_keep += DISPLAY
Defaults:WINDOWS_USERS env_keep += XAUTHORITY
Defaults	!lecture,tty_tickets,!fqdn

# User privilege specification
root	ALL=(ALL) ALL

# Members of the admin user_alias, defined above, may gain root privileges
ADMIN ALL=(ALL) ALL

# The WINDOWS_USERS may run WINDOWS programs as user windows without a password
WINDOWS_USERS ALL = (windows) NOPASSWD: WINDOWS

There's really not much too it without the comments

STEP 3: Move your .wine directory over to the windows user's .wine directory

sudo mv ~ron/.wine ~windows/.wine -iv
sudo chown windows:users ~windows/.wine/ -Rfv

STEP 4: Let the windows user have access to your display
This command has to be issued from the user shell (not root)

xhost +local:windows

Issuing this command will only work until you log out. To make things permanent, add the command to System>Preferences>Sessions>Startup Programs in the desktop of each of the Windows_Users

STEP 5: Run your windows programs with sudo, no password required.

sudo -u windows -H wine notepad

You can use variations of this command in your graphical menus for any wine program that you want to run from the system wine. You will have to edit the menus of each indivial windows_user for any system wine programs that you want them to be able to run.
If you want to run or install programs for yourself (not for all the windows_users) just use wine without sudo like this:

wine notepad

What should I do if things go horribly wrong?

sudo mv ~windows/.wine ~ron/.wine -iv
sudo chown ron:ron ~ron/.wine/ -Rfv
sudo deluser --remove-home --backup windows
sudo cp /etc/sudoers.bak /etc/sudoers

Remove the xhost +local:windows from your startup programs if you put it there.
Remove the sudo -u windows -H from any menu items that you edited

This moves your wine directory back, puts the file ownership back in your name, completely removes the new user and replaces your sudoers file. Remember that you can even replace the sudoers file from a live disk if things go horribly wrong and you can't log in or get root privileges.

Broader applications
After looking at the above information, it should be a simple exercise to modify my steps to run any program, including a browser like firefox, as a different user on your desktop.

Closing Thoughts
a. Remember to add the windows user to the appropriate groups so that wine can access the necessary system resources: cdroms, sound, floppies etc.
b. Remember that if you want to add a new system administrator that you not only have to add them to the admin group, you will have to edit /etc/sudoers to add them to the ADMIN user alias.

Test Systems
Ubuntu Hardy 8.04 on Dell Inspiron 5100
Ubuntu64 Hardy 8.04 on a homebuilt quadcore
Ubuntu Intrepid 8.10 circa 9/11/08 on a homebuilt quadcore (I got nano as the editor for visudo instead of vi)
Ubuntu Jaunty 9.04

Credits
Link:Running Firefox as another user, using sudo
Link:Running firefox as a different user Thanks Gaten for post #5
Link:suauth and pam.d Thanks HalPomeranz for post #16

Disclaimer
As always, this worked for me, but YMMV. Read, think and remember that I am "just some guy on the internet" before you apply changes to an important system.

[wdypdx1]

Excellent! Even though I haven't tried it yet.

Today I posted this,
http://ubuntuforums.org/showthread.p...33#post5878033

over in the wine forum.

For some reason my forum search didn't get me to your thread. I found it over on the WineHQ forums searching for an answer to the multi-user question.

I'll be trying your method later this evening.

wdy

[binbash]

Awesome howto, i will give a try

[wdypdx1]

Question on this Howto...

I already have wine installed and just a couple of apps so far, and no worries about any data, etc. So, do I need to uninstall/re-install wine, etc, so that I have a fresh start for this Howto?

Also, I'm assuming that I do this through my primary admin user account.

- wdy

[rsay]

You can go through the howto in any account that has sudo access. This means anybody in your "admin" group. This will certainly include your primary user but could include others that you have added to the admin group.

As far as your current wine installation you just have to decide what you want to have where.

If you want your current wine installation to become available to all users and to start a new "personal" wine installation then move the .wine from your home directory into the /home/windows directory. (This is the way I did step 3, by moving my personal wine into the system wide wine.)

If I wanted to start a clean shared wine installation, I could simply copy the .wine folder of any user that had not installed anything in their personal wine yet when I got to step 3. On my system Mason doesn't have any programs installed on wine. In fact he's never even run winecfg so he doesn't have a .wine folder. I would switch to his account, run winecfg, come back to my account with sudo access and then copy his .wine directory over to the shared wine install.
Alternate Step 3

 
su - mason 
winecfg
exit
sudo mv ~mason/.wine ~windows/.wine -iv
sudo chown windows:users ~windows/.wine/ -Rfv

If I didn't have any user without wine programs installed I would skip step 3 altogether and do the following in step 5.

Alternate Step 5.

sudo -u windows -H winecfg
sudo chown windows:users ~windows/.wine/ -Rfv
sudo -u windows -H wine notepad

[snkiz]

Background:
2.2 Edit /etc/sudoers, but only with visudo.

why this program is the most god awful thing I've seen in linux to date can't you just use nano or gedit?

[rsay]

The reason to use visudo is so it can do syntax checking. As I mentioned, the sudoers file is important to the functioning of your system and not forgiving when it comes to errors. Fortunately, the syntax checking isn't tied to a specific editor.

If you're a dyed-in-the-wool nano user, you can do this:

sudo EDITOR=nano visudo

Xedit is probably the closest command line editor to gedit.

sudo EDITOR=xedit visudo

I'll update the guide with those options. Thanks.

[snkiz]

hey thanks digging deeper for me. Google only works if you know what to look for, some posters forget that sometimes. lol I was mad when I wrote that, I did manage to find a reference to using other editors in the man pages but couldn't figure out how. I did finaly figure out vi, after throwing my mouse once or twice. I'd like to suggest you add in that the order of the text is important. And the default is wrong if you try to add the new lines under the headers as they are. Once I figured that out it was a matter of deleting everything under the ##info, paste in yours and edit the users. Hope you don't mind. But hey it was an achivement to do all that with vi. Just a thought, sorry if its been said before. But it would be nice if wine could be made to place launchers in usr/share/local/applications so they show up for everyone. I'll see if I can find out how after the hockey game. Cheers!

[rsay]

Let me know if you find out how to get wine to place the menu items. That would be a great addition for the howto.

[snkiz]

Let me know if you find out how to get wine to place the menu items. That would be a great addition for the howto.

Sorry for the wait life gets busy some times. My firstlook has reveled that wine places .desktop files here ~/.local/share/applications/wine/Programs and desktop directories here ~/.local/share/desktop-directories and icons here ~/.local/share/icons so could we simply just simply symlink into /usr/share/applications/wine/Programs, /usr/share/desktop-directories, and /usr/share/icons? any thoughts?