For a user on a Linux host, I need to make everything inaccessible besides his home directory.

I have heard that this is usually done by changing the root directory for the user (and setting it to the user's home directory), however I couldn't find the way to do it.

I thought about the chroot command, but it seems it just runs the specified command, considering the specified directory as the root directory. So it seems chroot is not what i need.

So my question is: what is the command which changes the user's root directory?

  • @user257493 As i understood, at /etc/security/chroot.conf i have add lines like: user1 /home/user1, and /home/user1 will be the root for user1, right? Should i restart something to make the modifications at /etc/security/chroot.conf to take effect?
    – Vahagn
    Oct 5, 2010 at 21:05
  • 1
    i think this question needs clarification...
    – JT.WK
    Oct 5, 2010 at 23:20
  • If you make everything inaccessible except the home directory, the user can't even run commands, as those commands arn't in his homedirectory
    – nos
    Oct 5, 2010 at 23:29
  • I gave you a new answer to your question. I don't think you'll like it though. Oct 6, 2010 at 10:34

8 Answers 8


It sounds like you want to change the HOME dir, not the root dir. Root will always be / or /root.

usermod -d /path/to/new/homedir/ username
  • I need to change the root not the home.
    – Vahagn
    Oct 5, 2010 at 21:06

To be sure that " everything inaccessible " behind this home directory, i would use chroot, but after you cannot do anything if you don't prepare the chrooted directory, you don't have any binaries or libs available.

The configuration of FTP server can be useful for you : http://tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap29sec296.html

It is a full chroot settings set to restrict the ftp users to this chrooted directory.


I stand by this answer, and I don't care if I got a -1 over it. This isn't something Unix can do for you in any reasonable kind of way. You're asking for something that's practically impossible.

But there is sort of a way to get something like what you're asking for, kind of. Use a virtual machine. Set up an instance of the virtual machine for the user in question and only give them login rights on it, not the host OS.

Here is my original answer:

Just use permissions. That's what they're for. A user generally doesn't have access to write to anything other than /tmp and their home directory anyway. And they have to have read access to /bin/, /usr/bin, /usr/lib, and /lib or they aren't going to be able to do anything at all.

If you really want something more strict than permissions give you, then looking into setting up selinux so you can restrict them further.

Using chroot just isn't going to give you what you want. It's really complicated to set up, and there are ways of getting around it.

  • @Omnifarious I need user1 not to be able to see the rest of world. Solving this issue with permissions means to modify the rest of world, rather then modify user1. I need a solution which solves the issue by modifying user1, not the rest of world. Yes, if the root directory of user1 is it's home, then it has no direct access to directories like /bin, but i can create a symbolic link to /bin in user1's home directory, thus deciding what he can see and what he cant.
    – Vahagn
    Oct 5, 2010 at 21:25
  • 1
    @Vahagn: Symbolic links will let the user access things outside of their chroot jail. Hard links will, but they cannot span filesystems. cd /home/new_guy ; ln -s /bin ./bin ; chroot . ls bin
    – nategoose
    Oct 5, 2010 at 22:47

see the manual of useradd. You have to use the -d switch.

  • I need to change the root not the home.
    – Vahagn
    Oct 5, 2010 at 21:07

I think if you add

if grep "\\<${USER}\\>" /etc/jailbirds > /dev/null
    echo I am not a crook
    exec chroot $CWD

to the end of your /etc/profile you might get what you are asking for, but it may have some side effects I'm not aware of (taking over the shell running /etc/profile might cause problems). In this case you would need to create a file /etc/jailbirds which was a list of the users you wanted to chroot for. You'll also need to make sure that this file exists and decide what to do in the case of errors accessing it to make sure that other users (especially root) don't get locked up by chroot

Additionally, doing this is going to be difficult. The user will be unable to access /proc which will make many shell utilities (such as ps, top, and many others) not work. The user will also not be able to access /dev/null, which will break lots of stuff.

The user will also not be able to access /dev/tty which will break less and more when used with standard input. The user's applications will inherit the stdin, stdout, and stderr open file descriptors from before the chroot, but less opens /dev/tty so that it can get keystrokes from the user to deal with having stdin redirected from a pipe.

You will also not be able to access any programs or shared libraries or many files that live under /etc (such as /etc/protocols ) that many programs use.

All of these are things you can work around, but you will end up needing to do a lot more work to make the users' environment usable than I think you have considered.

If you do try my suggestion I suggest you be very careful. It would be easy to get it wrong and mess things up bad. I have not tested this, by the way.

usermod -d /path/to/new/homedir/ username

That answers your question but I'm not sure it's what you need?

  • I need to change the root not the home.
    – Vahagn
    Oct 5, 2010 at 21:06

I think you are slightly confused. The directory /root will only be accessible by the root user. Each user generally has their own HOME directory in /home/, and the root user of the system will posses /root

If you want to change the HOME directory follow some of the other answers, or edit the /etc/passwd file

  • root user is god; can see and do anything anywhere. Puny user can only see and do his own domain; rest of muliverse is denied.
    – bbaja42
    Oct 5, 2010 at 23:36

Create a guest user

useradd -s /bin/sh -m guest

Install a shell for them that does not depend on third party libraries

cd /home/guest
apt-get download busybox-static
dpkg -x *.deb .
rm *.deb
cd bin
./busybox --install .

Change your root directory to /home/guest and run as guest

mkdir /home/guest/etc
grep guest /etc/passwd > /home/guest/etc/passwd
chroot /home/guest /bin/sh
exec env -i login -f guest

Inside the chroot, you can install and spawn an ssh server, so that the user can log in remotely; although you may run into problems when certain applications want access to the /proc file system and friends; in that case you may begin to tread on lxc containers, namespaces, virtual machines, etc where something like schroot or qemu become an easier option.

If you stick with a home grown solution, you may run into security issues if you are not careful (such as accidentally giving ownership of /home/guest/bin to guest, in which case guest may get to run as root next time you invoke chroot).

I have no idea if the above commands are what you want and/or if they are vulnerable to any security holes. Hope they help though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy