Fully separate two accounts without installing separate operating systems?

Question

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install two separate operating systems; due to that fact, that we will need sudo ability, but he doesn't want us to be able to break the OS for the other person (by either playing war games or by making mistakes). His solution is to install two separate operating systems, but I dislike this idea for a couple of reasons. First, we have MBR, so that limits the number of partitions; and second, it's just annoying because they are both Mint Linux, so we'll choose the wrong one a good deal of the time. Anyone know of a way of separating the two operating systems so one person can't screw it up for the other? I'm less worried that we'll play war games because we could do this with the separate partitions and because it's less important. Anyone have any ideas?

I was thinking of limiting the power a user has while still allowing them to use root; however, this could cause problems later on. The teacher wants to control the root account of course.

Answer 1

There are two obvious answers:

1. Give each user his own virtual machine image. Inside the virtual machine, the user has root access; outside the virtual machine, none at all. If your hardware supports it, kvm will work pretty well for this. And virtual machine images are just files, so they're easy to copy around, etc. You can use copy-on-write storage, which will save some disk space, if that's a concern.
2. Use the newfangled namespaces support in Linux 3.8, which actually allows everyone on the machine to have root in his own area. Depends especially on what you need root for. (Though, you can actually run an entire separate distro inside a namespace, it just has to share the same kernel).

Unlike separate partitions (which are very easy for root to mess with—just mount it), the above two actually are secure (well, you have physical access to the machine, so those vulnerabilities apply regardless).

There are more painful things too, like capabilities and SELinux, depending on why you need root (sudo) access. Or, of course, if you just need a command or two, sudo has built-in support for limiting which commands may be run.

edit: For more information on namespaces, see Namespaces in operation, part 1: namespaces overview, which has six parts in total. Namespaces have been going into Linux slowly, starting several years ago. Part 5 and 6 cover the final part, added in 3.8, which allows any random user to have root in his own namespace.

Answer 2

Instead of installing two versions of the same OS, the teacher can just set it up once with the root filesystem on a logical volume then set up grub to boot from two different snapshots of that one LV. He can put your names in the boot entry so it's easy to pick, set a password on grub, and disable the grub timeout (so you don't feel rushed to pick something). He'll just need to make sure the snapshot has enough space to cover what you guys are going to do with it.

If he need to update the referenced LV he can edit the command line on one of the other entries (after entering his password) and just change root= in the kernel args to be the actual LV instead of a snapshot.

This would do what he's wanting in a little more resource-conscious way, but ultimately it's a bad idea.

Ultimately, I'd try to explain to him that with LiveCD's he's probably peeing in the wind, if you guys are wanting to do that, installing to two different partitions or booting from a snapshot doesn't stop you, it just changes the exact steps you'll go through to do it.