On rstudio-dev I've just installed a new version of the r-connector script that:
- do not allow the creation of non ldap users (it logs an entry in /var/log/syslog)
- sets the new users home directory permissions so that the gcube user can update the
userconfig.csv file
- creates the link
.Rprofile -> /srv/d4science/RStudioConfiguration/.Rprofile, where the source is the Rprofile downloaded from subversion
I also installed a cron job that executes a cd /srv/d4science/RStudioConfiguration ; svn update so that any modification to the master will land into the users home directories in at most 24 hours.
I already tested that the new permissions (example):
drwx--x--- 6 andrea.dellamico gcube 126 Oct 21 17:46 andrea.dellamico
drwx--x--- 6 andrea.dellamico gcube 126 Oct 21 17:46 .
drwxr-xr-x 24 root root 4096 Oct 21 17:41 ..
drwxr-xr-x 3 andrea.dellamico ri 23 Oct 21 17:45 .cache
drwxr-xr-x 3 andrea.dellamico ri 40 Oct 21 17:46 R
-rw-r--r-- 1 andrea.dellamico ri 12118 Oct 21 17:45 .RData
-rw-r--r-- 1 andrea.dellamico ri 141 Oct 21 17:50 .Rhistory
lrwxrwxrwx 1 andrea.dellamico root 45 Oct 21 17:41 .Rprofile -> /srv/d4science/RStudioConfiguration/.Rprofile
drwxr-xr-x 13 andrea.dellamico ri 4096 Oct 21 17:50 .rstudio
drwxr-xr-x 3 andrea.dellamico ri 61 Oct 21 17:41 .subversion
-rw-rw---- 1 andrea.dellamico gcube 8 Oct 21 17:50 userconfig.csv
are sufficient to permit the writing of userconfig.csv. When @gianpaolo.coro@isti.cnr.it will be able to confirm that he cannot read my files from his session I'll distribute the scripts on rstudio.d4science.org and dataminer1-proto.d4science.org.
I will then proceed to the local users removal (already done on rstudio-dev)
Note to @gianpaolo.coro@isti.cnr.it: the text
print(paste("*****************SECURITY NOTES*******************"))
print(paste("By default, all users can watch the files of the others"))
print(paste("-But they cannot alter them-"))
print(paste("In order to definitely hide the contents of your workspace, please launch the command:"))
print(paste("system(\"chmod go-rx $HOME\",intern = FALSE);"))
print(paste("***********************************************"))
is dangerous (it's also becoming obsolete, but): if you remove the execute permissions to the group, the r-connector isn't able to write the userconfig.csv file anymore and the user session cannot be opened.
Updated by 
