Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just read up on setting up user privileges for different kinds of users. Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else. Also, he should not be able to view another users files within /tmp, let alone delete them.

I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.

However how would i go about removing the users write access from the rest of the system?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else.

In a standard Linux installation, users can write only to /tmp and their home directories. So you can achieve this by making a user's $HOME read-only and owned by root.

Also, he should not be able to view another users files within /tmp, let alone delete them.

Give all users a restrictive umask (such as 077) through pam_umask, and set the sticky bit on /tmp.

Also, play with pam_namespace - you can give each user his own /tmp.

I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.

Incorrect. Without execute permissions on /tmp, the user won't be able to access or create anything in that directory. Without the sticky bit, anyone who can write to /tmp will be allowed to remove anyone's files.

However how would i go about removing the users write access from the rest of the system?

They don't have write access by default. See top of this answer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.