I would like to add special user (ideally manually add to files controlling users and groups, so not use any utilities for this, because my system is read only) with these specifications (my system is Debian):

  • this user will be used just for running specific program
  • he can't log in to system as a standard user and any other method such as ssh, ftp, etc (so this user will be just for running specific program ONLY, so no other action is allowed. This user will be used to run a script via rc.local and from another python script)
  • not allowed to become sudo/su
  • he must be able to access /dev/spidev1.0
  • this user doesn't need to have his own /home/thisuser dir
  • he can't be able to access files in dirs such as /home/otherusers

How can I do this please? Any step by step guide?

  • 1
    I'm assuming you'll use su to switch to this user for running this program, or how will the user run the program? – Service Manager Apr 10 '17 at 15:25
  • If you look in /etc/passwd you will probably find a spare entry for your purpose, eg in my Ubuntu 16.04 there are users games and nobody, which might be suitable, as neither is permitted to log in. You can launch the program with su, sudo or (if only this user is allowed to run the program) by setting ownership and the SETUID bit in the program. – AFH Apr 10 '17 at 15:50
  • @ServiceManager, Yes, it will be switched with su but from another account (with allowed permission for su). – peter Apr 10 '17 at 15:50
  • With the adduser command you can create a new user, like thisuser.
  • Then you can edit /etc/passwd, search for the new user, and change the end of the line from bin/bash to bin/nologin.
  • If you don't add the user to the sudoers, it can't use sudo. Su however is always possible from any user, if you know the password of the user you want to become. This is no issue.
  • /home/thisuser will exists, but does no harm and can stay there.

What is /dev/spidev1.0? Is that the script? Or a program? If it's a script you wrote, you can use chown to make thisuser the owner. Otherwise you can add thisuser to the spidev-group (if that exists) using usermod.

Something like this? You'll have to modify this.

sudo adduser thisuser
sudo vim /etc/passwd
sudo usermod -aG spidev thisuser
  • thank you @SPRBRN! /dev/spidev1.0 is gpio pin for external device. Probably I can limit external device access too with chmod, I must check it. – peter Apr 11 '17 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.