Prevent program from beeing run on other machines

Question

I have a linux executable running on my Ubuntu Machine. I want to grant access to a user in order to execute the program, but I don't want this program to be copied.

I was thinking into making a simple crypter app that will decrypt the program at run time an run it from memory.

Is this feasable ?

Answer 1

You can

chmod -r program

The executable will still be runnable, but you cannot copy it.

I just tested that on Ubuntu 14.04 with a downloaded eclipse binary - it worked.

Please note that this will only work for binaries. It will not work for script files that need to be read and interpreted by a shell or interpreter.

Answer 2

It depends hard on the kind of attack a potential user would be able to do which relates typically to the commercial value of a successful attack.

First of all:

If a user have physical access to the storage there is no chance to protect anything from copying. Simply by booting with another OS make all system internal protections baseless. This will be true for the protected program and also all the programs which do some kind of obscure security features like decryption. You can boot a pc from usb or any other media. Forget about something like rights managements supported by the OS.

To hack the mac address on a pc is something that can be done in a few seconds. Load a kernel driver which register a pseudo network card and you will get any fake mac you want. Who will protect the pc for running with modified kernel?

The next is, that any kind of decryption will result in a memory map which hold the executable during runtime of the prog. Any low privileged hacker can get a copy of this memory and can create a application to get this image to run on any other machine.

As you can see on real world licensing models, the only chance is to use additional hardware which is fully secured like crypto usb sticks or other kind of ciphering agents. Another trick can be some kind of online key repository. But all this can not be done by simply implementing some crypto algos.

If you have a product which must be protected against illegal usage, you have to use a commercial protection.

Sorry that I can not see which is your intention from your question. If you only want to keep a simple application with no commercial value on one pc for a "friend" or you have to secure the income of your business :-)

Answer 3

If I'm understanding, you have a user logged in who needs to run program X but not copy program X?

One way, if this is a compiled executable, is to set execute only, but double check your suid_dumpable kernel setting.

If it's a script, or if you have configuration files that go along with it and those need protection, then the /etc/shadow pattern applies: users need to be able to read that file, but not copy it elsewhere for attack. For this pattern, the solution is to use a mediator program. Specifically, the program can temporarily increase its privilege to read the file, but cannot be coerced into providing access to anything in the file beyond what exactly is needed to run.

The accepted answer to this question explains nicely the variety of options. I personally like the sudo approach.