Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a Linux distribution that prevents root user from modifying/deleting files/directories in another user's home? I came across tools that allow the home directory to be encrypted. But I want other users to be able to read the files but not modify or delete them.

If this is not possible in Linux, does any of you know of any other OS that allows this?

share|improve this question
That kinda defeats the purpose of having a root user. Can you elaborate why you'd want that? – slhck Apr 17 '12 at 13:54
@slhck since the files in a user account won't interfere with others usage of the system, I don't see why this can be a problem. The root account can be used for common operations like installing software to be used by everyone. – Can't Tell Apr 17 '12 at 14:00
Why do you want root to not be able to delete files in another user's home? This is the point of root user, to have access to all the files. – Renan Apr 17 '12 at 14:06
@Renan But doesn't that compromise privacy? – Can't Tell Apr 17 '12 at 14:11
@Can'tTell Yes, this is why you need to be careful with the root login. – Renan Apr 17 '12 at 14:11

You are asking the wrong question if you want an answer other than "No" - root can not be hindered from doing anything (including changing permissions, but can *deity* set permissions so strict that even it can't bypass them?).

What you probably want is to be able to give out some administrative privileges (installing programs and such) to users without making them almighty on the system. For this you can use e.g. sudo with restrictions on a user/group level.

share|improve this answer
Thanks for your answer. Is it possible (by editing the sudoers file) to allow a user(other than root) to do everything that root can do but not modify other users' files? – Can't Tell Apr 17 '12 at 16:25
@Can'tTell: It's difficult to say "no" without being comfortable with every aspect of a program, but: no. sudo is used as a white list (allow specific applications to be used) and not a black list (deny specific operations), and what happens with the white list is that those programs are run with root privileges. If you want users to be able to e.g. install programs: allow apt-get or aptitude or what you use. Often one writes wrapper scripts that are allowed sudo privileges to be able to control access. It's a never-ending topic on itself, though, not fit for these comment boxes. – Daniel Andersson Apr 17 '12 at 17:42

The root user can modify anything in any user's home, this is by design.

To have users be able to read, but not modify files, you will have to use groups and give the files read-only group permission. An example, which illustrates your use case, is available from here:

share|improve this answer
But I want to prevent the root user from deleting/modifying files in user home as well. – Can't Tell Apr 17 '12 at 14:08
@Can'tTell this is not possible, by design the root user has access to modify/delete all he wants. Doing otherwise sort of defeats the point of a root user. – Renan Apr 17 '12 at 14:09

If you change your /home directory to be an NFS mount instead, you can use the root_squash option to have the root user on the local box map to an anonymous user on the NFS server. This would prevent root on your box from being able to modify the files in /home.

However, while root can never modify other user's files on the NFS server, beware that there are malicious things that root could still do. For example root could unmount /home and replace it with a seemingly duplicate /home that it could write to. It could also mount a fake filesystem over the top of another user's home directory that it could also write to. While the original files would still be safe and untouched on the NFS server, your users won't know how to look for this trickery and you might run into whatever problem you were trying to avoid.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .