I just read up on setting up user privileges for different kinds of users. Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else. Also, he should not be able to view another users files within /tmp, let alone delete them.
I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.
However how would i go about removing the users write access from the rest of the system?