This evening I had a great chat with a guy named David. He’s a 9th grade science teacher in Minnesota. He’s working on a project called Growing Communities Of Scientists in his school. He plans to use a set of “computer enabled science classrooms” which embed thin clients into a student group workspace. David’s also got a great blog where he’s been journalling his experience. This means students have access to computers without interfering with they’re normal learning/social area. A common sight I’ve seen in most computer labs is individual students with hardly any working space and fairly isolated from each other and the instructor. It’s sort of like a cubicle effect. For sciences were you’re trying to get a lot of hands on instruction it’s rather difficult.
So, back to Edubuntu. While David’s been working on the hardware of his computer enabled science classroom he’s also been working on getting LTSP set up along with Ubuntu/Edubuntu software he needs to manage his classroom and teach his students. He’s run up against a problem that is fairly common to educators but is pretty difficult to work with on Linux systems. Simply, he needs to control access to applications. He wants to implement a rewards system where students gain computer privileges (getting to use Firefox, etc.) based on being responsible with current privileges. One of the things that’s great about Linux OSes is that you can install software system-wide and is supposed to be multi-user friendly. However, in this case, that freedom is a problem. I’d love to hear some suggestions on how to accomplish an application whitelist system in Ubuntu.
OK, but back to the title, why we need Edubuntu to succeed. The reason I say that is that Ubuntu and Linux/FLOSS in general needs advocates on behalf of students, educators, and the next wave of technolgy users. People generally tend to stick with the OS they first learn so one of the best ways to make Linux maintstream is to get it into schools.
The problem is that most software development in FLOSS is not centered around education. There are education-specific applications out there (Sugar, gcompris, KDE Edu) for sure, but the OS itself is not always education-friendly. I’ve seen a lot of educators trying to deploy LTSP servers in their schools struggle with applications that don’t behave well with multiple users, even common ones like Firefox and OpenOffice.org. On top of that key needs such as practical user and group management for educators is almost non-existent.
In many ways, one of the primary jobs of Edubuntu is to provide an advocate for educators and students to Ubuntu and upstream software developers. It’s not just about a making a way to install Ubuntu educational software easier, it’s about it’s about listening to educational user’s needs and trying to make some of those dreams reality. If Ubuntu can’t be “Linux for learning human beings” I’m not sure it can really make it mainstream. I’ll go out on a limb and say, as we start 2009, forget the “Year of the Linux Desktop” and look towards the “Year of Linux in Education” 🙂
LaserJock 
Greetings. A few months back, I was in a classroom at my college (a “smart” classroom) and there was a program there (granted, for Windows) that enabled the instructor to control access to different aspects of the student’s programs, including access to different programs.
This inspired me to see if there was a comparable program in the open source world, just out of curiosity. There is. Unfortunately, I cannot remember the name of it, but I know that I found it in a forum via google. It does exist!
Hi,
The maturity or functionality of the software is an issue but since skoelinux/debian-edu/edubuntu are being used in German, Sweden, etc.today, its not the only issue. I was part of a tiny effort to get ANY linux box into an NY school and time and again the decisions about even allowing one donated computer setup was met with folks saying that they had no authority to allow such a setup as the IT decisions were done at a state-wide or district level. So what ever the software could or could not do never even entered the picture.
Regarding an application whitelist.
What about doing the same as with devices? Setting the permission on certain binaries in such a way that the user has to be part of a specific group to have permissions to execute them?
Hi,
I can see how Firefox would need some kind of multi-user-ness. For filtering etc, and turning off scripting etc for students. I think there is an Ubuntu contributor on Planet Ubuntu that does a lot of stuff on this. And has come up with a decent way of locking down Firefox.
For OpenOffice I don’t see why that has to be “multi-user”? Surely the pupil should have complete access to all the features of OpenOffice? What aspects of it would need to be different to say the Teachers version?
Implementing the variable-white list, could be as easy as creating different levels of user account. A deamon process keeps track of certain measurable quantities, and when a pupil reaches a certain threshold, their username is added to the user list of the next “user level”. Allowing them access to Firefox. I suppose it’s a more granular version of “sudoers”.
But don’t schools teach what people use? I remember my early education environemnt filled with Apple IIe and etc. but by the time I got to higher levels all the Apples were replaced with Windows. Since businesses were using windows, universities were teaching windows.
Mitch:
1. If you can use 1, you can use the others. GUIs are pretty much self-explanatory.
2. We’re talking about science here. Science students in my university are required to learn FORTRAN or C usually, and the platform they use for running their simulations is Linux.
Dan:
I think you mean iTALC
@Andreas and Frank: Yes, we could do limited whitelisting by changing the permissions but I don’t like the idea of mass editing system-installed binaries. What about doing it via PATH?
@Ciarán: sorry, I might have been mixing too many things. I didn’t mean multi-user in the sense of controlling the application’s features. I meant that on multi-user systems such as an LTSP server there are often problems that are *only* seen when multiple users are logged in at the same time.
@Mitch: yes and no. There is certainly a “chicken and the egg” aspect to all of this. But educators actually need to be teaching kids how to user software and more importantly the software of tomorrow.
I know lots of people who use Macs still purely because it was what they used in school. Those early Apple IIe’s were quite influential.
But don’t misunderstand by desire to see Linux/FLOSS succeed as just anti-MS sentiment. I want it to succeed because I firmly believe we can build a better computing experience for educators and students that will hopefully serve them well into adulthood.
Why not just create a group “firefox” and chown firefox:firefox the firefox binary?
F
Mitch:
Schools have to teach skills that are useful in the real world. What if a mechanic was only taught how to repair a ford because that is what everybody was driving (in the T-era it really was you know). Than we would have only Fords to drive in these days. I think it’s the other way around really, people use in business what they wee thaught in school. Microsoft thinks so too, that’s why they almost give away software to the educational sector, to lock-in future employees. It is very important for schools to teach in multiple os’s and other software. To see what they have in common, and also what differs them.
As for the question the blogger asked: I go with Andreas, groups are the way to go…
@Frank:
Right, I didn’t mean actually editing the binaries themselves, but the permissions, I should have been more clear there. And I think you’re right with the “flathead for a philipshead problem” comment.
I’m just nervous about changing system-wide files.
@I don’t like the idea of mass editing system-installed binaries
You’re not “mass editing binaries”, you’re just changing ownership. The downside with this method is that it may break when firefox is updated. The upside is that you only have to write a script to set ownership “once”, and rerun the script occasionally.
@changing the $PATH
Probably the same amount of work, but it seems like you’re using a flathead for a philipshead problem. The downside of this is that you have to manage the path for each group of students seperately. And the PATH, for a single student, changes as they gain privs. So more repeat work (make a number of template .bashrc files). A student can change their $PATH back to whatever they want, whenever they want, so it probably won’t last to long if they’re over 10yrs old.
If you’re already in the .bashrc, you might as well just alias firefox=ls. It is just as secure as the PATH solution and doesn’t futz with anything important.
F
Nice dialog!
Dan, I’d agree with Mitch–all I’ve found that seem to relate to computer lab/user management are: iTALC, Sabayon, Pessulus, and Edubuntu-menus.
Kevin–I agree, getting computers into a school is hard. The reasons are complex, some obvious such as resistance to unfamiliar technology and team (Mac or Windows) spirit that doesn’t want the competition. Understanding the barriers to acceptance is half the battle. It sounds like you’ve got some experience with this, wanna add to the wiki page which has a section on Challenges at https://wiki.ubuntu.com/MinnesotaTeam/Education
Andreas–interesting sounding idea! Using an already developed structure for this purpose sounds efficient–I’m looking for a work around right now that wouldn’t take too much to get going. I have no idea on the details or practically of this. Anybody?
Ciaràn–I’m not sure if the guy you are talking about is Michael with his addon CCL (I think). I looked into this and then Conner McCall figured a way to do this (I think 🙂 with a squid proxy server. For sure about open office–this would be part of the ‘level1’ app package. Your idea of using a process similar to the sudoers sounds really cool, too. It sounds like what you are describing is something like a group, but you don’t use that word. Can you explain a bit more? Thanks!!
Mitch, Mackenzie, Willem– I agree with all. When students are in classrooms where they use FLOSS they won’t want to go back to propriatary/closed. FLOSS philosophy spreads throughout communities that commit to using this software. When classes, schools and districts start to get connected to the larger open source community, well, it grows on you. I’m sold on FLOSS for many reasons–mainly the community and the openness of the ‘tools’. The sky IS the limit.
Jordan, THANKS for this wonderful post! I’m not sure where to develop the discussion you started here on possible solutions like yours (which I don’t know what PATH is) and Andreas and Frank’s. I’ll try on #Edubuntu right now!
Have you looked at “kiosktool”?
It’s a KDE application that lets an administrator control the user’s environment and access to programs.
The administrator can define groups and assign users to them.
“I’d love to hear some suggestions on how to accomplish an application whitelist system in Ubuntu.”
Speaking on the infrastructure level, this could be done via access control lists (ACLs). I believe these are supported in Ubuntu, although there are difficulties when trying to apply ACLs across networked file systems (this is a generic problem, not a Linux- or Ubuntu-specific problem).
Administering ACLs can get complex, so you’d probably want a friendlier interface to the basic tools. But this might give you a place to start looking…
@mariner: I know a little about it but we’re mostly Gnome-based and kiosktool is still KDE 3 as far as I know. Will be something to look into though.
@Vance: thanks for the suggestion
@Andreas: I was talking with David this evening on IRC about doing just about that. Good tip on suid binaries. I’d personally like to wrap it up into a Python GUI to make it easier for teachers to use.
David:
If I were to build a solution I guess I’d roughly do something like the following:
First (manually) create a list of the binaries you intend to restrict and which groups to match them against. It might be a good idea to put this information in a database. If you don’t already run a full database server then sqlite might be a good option
Have your script read the list of intended groups, check if they already exist and if not, create them. I guess it’s more fitting to create system groups then user groups.
Scan your list of files for the current/original set of permissions and ownership. This information might be useful to save in your database, for future restores.
Set the new ownerships. I guess $orginaluser:$newgroup and 750 should do fine
(By the way, watch out for setuid binaries and other special cases. Actually it might be best to make sure you leave them alone, just to be on the safe side.)
Bonus: Implement the option to restore restore the original permissions and ownerships. Might just come in handy.
It’s of course possible to do all this manually. That said, in the long run you’ll probably be grateful to yourself if you from the start take the time to write a proper (perl) script.
Actually, this is not necessarily the way I would do it. If I were to actually implement it myself I’d most likely give it some more thought. This is just the first idea which comes to mind. Still, could be a good one 🙂
@Jordan: Yes, a Python GUI sounds like a good idea if it’s intended for a more general use. Feel free to drop me an e-mail if you’d like any help testing the solution or such.
Perhaps other people have already said it, but here it goes nevertheless:
Use a group (like in /etc/group) for each application that needs control access. Say: a firefox group for firefox, another group for amarok (for the sake of the example) and so on. Then, set the applications to belong to that group, set the permissions so that only that group can execute it and then add/remove the users of the students to the groups as they gain/lose that right. That should pull it off.
Pingback: Ubuntu Look » Why we need Edubuntu to succeed
Pingback: Boycott Novell » Links 15/01/2009: GNU/Linux Tops Windows, OS X
I think that creating separate groups for controlled applications is the best way to control access to applications. This is completely out of the control of the users, yet simple to administrate after it is set up. You simply go to the user control app and add or remove groups to users’ lists.
*cough* “they’re” in the sentence “This means students have access to computers without interfering with they’re normal learning/social area” should read “their” *cough*
Unfortunately, the theory the author has offered is wrong.
If you want Linux to succeed, you don’t get it into schools first. That may have worked a generation ago, but almost all kids have home PCs that they’re working on now, and the OS on those PCs are being chosen by the parents.
If you want Linux to get mainstream, you have to go in the other direction — you need to get it into the business sector, let it seep into the domestic sector and get *parents* interested first.
LInux just totally rules, It just doesnt get any better.
RT
http://www.privacy-center.be.tc
Cool, you’ve been digged 🙂
I am from India and we have been able to put school wide edubuntu in one of the school I was associated with. Teacher were not comfortable with the idea of Linux as the general psychology is that “Linux is for nerds not humans”. Also, we faced a lot of resistance from students.Because Edubuntu is open source, we just replaced the keyword “edubuntu” with “vista” and
told teachers that we have upgraded their XP machines with Vista. They used it for 15 days and loved it. Later on, in a meeting , we just disclosed that it was not vista but edubuntu. Now everybody is using Edubuntu in school and we are 100% open source now.
“People generally tend to stick with the OS they first learn”. This is the only reason why Microsoft is partnering with lot of state Government in India and distributing their softwares in rural/metro areas for almost free. Sounds like a good business model to me.
I am not anti-microsoft. But, I just believe that open source is the only way to do scalable ICT projects for education in developing countries like India.
This is a somewhat response to Kevin Mark who had trouble getting edubuntu into schools in NY. I have had similar experiences but what I’ve been able to do is start to integrate individual software. For example at an afterschool program I was able to get tuxpaint and other linux friendly educational programs on the computers. Then I actually started my own educational program called Platinum Arts Sandbox which makes it easy for kids to make their own 3d games and worlds. I started talking to different schools I worked at about it and they were interested in showing it to the kids. It got to the point where at several schools I was showing off the software and even got a job teaching with it at an afterschool club and pretty much free reign to put what I wanted on the computers. I think that with the success of these individual programs, hopefully it will open up the eyes of school administration that hey there is a lot out there to help our kids, and it conveniently doesn’t cost much either. So in any case what I’m trying to say is that maybe we can use some of this great edubuntu software to help make steps towards opening eyes about what is out there and hopefully that could lead to full edubuntu adoption. If nothing else at least these kids eyes are being opened to a whole new world of software, and stuff that they can put on their home computers for free. Anyway that’s my rant 🙂 Take care.
-mike
http://kids.platinumarts.net Free 3D Game Maker For Kids And Adults
I think the following would work for an application whitelist. If you make a firefox group and set the firefox binary to be owned by root and assigned the group firefox, and set the permissions accordingly, a student belonging to the firefox group could use it, and vice versa. E.g. (say /usr/bin/firefox-bin is the binary)
groupadd firefox
chmod root:firefox /usr/bin/firefox-bin
chmod 0750 /usr/bin/firefox-bin # rwxr-x—
Then you would do
usermod -a firefox
to allow firefox use.
Disallowing firefox use would be a rather more complicated operation. A command which would work would be
usermod -G `id -nG | perl -pe ‘s/firefox ?//; s/ /, /g;’`
Disclaimer: you might want to check all that.
Edit to the above. Should read:
usermod -a firefox username
and
usermod -G `id -nG username | perl -pe ’s/firefox ?//; s/ /, /g;’` username
I orginally put username between chevrons.
Pingback: links for 2009-01-16 at DeStructUred Blog
i think it deserves better name than ebuntu… no offence, all else is great
Thanks to all who shared ideas to address ideas on how to manage user privledges. I’ve copied and somewhat organized the ideas on the bottom of the Ubuntu wiki at this page: https://wiki.ubuntu.com/ManageGroups
summaries are welcome!
Pingback: the Mis-Edubuntu of Linux Systems « Black Maps: science + politics + comics + maps
yeah just make a group for every app why is this so hard
A few weeks ago I built out (volunteer work) a new computer lab at my daughter’s private school. All the computers are based on Edubuntu, but are stand-alone, not LTSP. Yes, we use iTALC for classroom management. VERY cool software!
Some parents were concerned about the choice of Linux instead of Windows. I’ve found that gentle, well-reasoned answers and hands-on experience do more to generate enthusiasm than anything else. We built a top-notch lab for less than $500/seat and no ongoing licensing costs. That included new dual-core computers and flat-panel monitors, as well as computer desks, task chairs, networking, etc. Everything from the bare walls is included in that $500/seat. Comparable public school labs often cost $5,000-$10,000 per seat when all costs are figured in.
The bottom line is that we couldn’t have done this without FOSS and the countless hours people worldwide have put into their pieces of the open source puzzle. I’m very grateful for the opportunity to contribute in my own small way to introducing parents, teachers, and students to a bigger and freer world of software choices than they’ve known before.
We’re still getting started, but when things get stablized a bit more, I hope to post a white paper on the computer club’s washad.org web site detailing our process and results. Schools which are even more cash-strapped might be able to build a lab for even less using refurbished computers, existing furniture, etc.
The bottom line is that FOSS opened up possibilities that probably would never have come to fruition with commercial software. I believe that in schools where attitudes of freedom and resourceful creativity are encouraged, true education flourishes. Where it is repressed, we all lose.
Just passing by.Btw, your website have great content!
_________________________________
Making Money $150 An Hour