Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just read up on setting up user privileges for different kinds of users. Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else. Also, he should not be able to view another users files within /tmp, let alone delete them.

I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.

However how would i go about removing the users write access from the rest of the system?

share|improve this question
up vote 3 down vote accepted

Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else.

In a standard Linux installation, users can write only to /tmp and their home directories. So you can achieve this by making a user's $HOME read-only and owned by root.

Also, he should not be able to view another users files within /tmp, let alone delete them.

Give all users a restrictive umask (such as 077) through pam_umask, and set the sticky bit on /tmp.

Also, play with pam_namespace - you can give each user his own /tmp.

I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.

Incorrect. Without execute permissions on /tmp, the user won't be able to access or create anything in that directory. Without the sticky bit, anyone who can write to /tmp will be allowed to remove anyone's files.

However how would i go about removing the users write access from the rest of the system?

They don't have write access by default. See top of this answer.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .