For some user 'bob' in Linux is it possible to restrict the stuff executable by 'bob' to specific paths only.

As an example suppose that the 'bob' has the home directory /home/bob

'bob' must not be able to read/write/execute (zero rights) anything above /home/bob ever.

/bin, /lib, /usr/bin, /usr/lib, /usr/local/bin, /usr/local/lib, etc. are explicitly given appropriate settings rx - so 'bob' can execute stuff from these paths but not write to them.

'bob' has rwx rights to own directory (/home/bob) but is it possible to disallow bob to execute stuff from his own directory by default and then allowing some stuff (launchers, scripts, etc selectively) to be executable by 'bob'

please note - 'bob' can compile own stuff in /home/bob and run that stuff (this should be prevented). Also 'bob' can always use chmod, chgrp, etc. on files owned by himself. What is needed is execution prevention - even on owned files.


Put home directories on a noexec file system. That will help prevent the user from executing binaries stored there, although it isn't a 100% guarantee.

Put any other user-writable locations such as /tmp also on noexec file systems.

Put anything you want users to be able to execute into for example /usr/local, owned by root and with appropriate permissions.

Note that this won't prevent parsers from parsing and executing code stored in bob's home directory. For example, a Perl script can either have its execute bit set and be executed as ./myscript.pl or it can be executed as perl ./myscript.pl in which case it will only be read as input to the Perl interpreter.

If you want better assurances than that, consider augmenting using chroot jails, SELinux, or possibly even removing bob's shell access entirely. If he's only allowed to use his account as glorified file storage, does he really need shell access in the first place? Might for example restricting untrusted users to sftp, SMB/CIFS/NFS or WebDAV access work better in your use case?

| improve this answer | |
  • Thanks for the quick response. What is needed is for 'bob' to be able to compile stuff (i.e. allow executing gcc or system installed firefox for example, etc.) ('bob' should not be able to copy or create a binary and execute it) – no.names.please Jul 31 '14 at 9:21
  • just for clarity - 'bob' should be able to run system firefox - but not a freshly compiled firefox binary by him - or - not a downloaded firefox binary. – no.names.please Jul 31 '14 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.