Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would I go about disabling reading from usb sticks but still have the ability to write to them? The reasoning is this is a public internet access (kiosk more or less) computer but we want the user to be able save files to a usb stick but not have the ability to save files to the machine or execute files from the usb stick.

Thank you

share|improve this question
Interesting problem: the USB drives are auto-mounted, so you'd have to work out how that happens, and whether you can configure a mount in write-only mode. – PP. Mar 2 '10 at 11:41
I never thought it would be possible to even have write-only storage (because you need to read the filesystem and all that stuff). – grawity Mar 2 '10 at 16:38
up vote 1 down vote accepted

If I were you, I'd leave the USB stick read-write (as that makes a lot of sense), but I'd set your machine's partitions to read-only. If you lock down X enough (prevent anyone from opening a shell via xterm, for example), then it should be a piece of cake.

Some notes : mount /var as a ramdisk? use noexec to prevent exection of binaries

It might be easier to just chroot execute the browser, with the USB-stick mounted under the chrooted jail.

share|improve this answer
i think that's what we will do.. – WalterJ89 Mar 2 '10 at 23:32

exec and noexec exec lets you execute binaries that are on that partition, whereas noexec doesn't let you do that. noexec might be useful for a partition that contains binaries you don't want to execute on your system, or that can't even be executed on your system. This might be the case of a Windows partition.

share|improve this answer
thanks for the link – WalterJ89 Mar 2 '10 at 23:29

Unless you control the USB sticks, write-only isn't going to work well. You're going to end up with all sorts of support issues and grousing by your users.

If I were you, I would setup the kiosks to run as dumb LTSP terminals, and start the users with a completely clean environment with every session. There are all sorts of ways to do this... my college had an XTerminal lab running on some ancient Unix back in 1994.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.