Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my Linux system I have two users, say A and B. I need to isolate B in such a way that B cannot be given access to A's home directory,even by A itself. How can I solve the issue?

share|improve this question

migrated from Nov 22 '11 at 16:38

This question came from our site for professional and enthusiast programmers.

Yes! B should be denied access from A's home directory even if A intents to do so by changing permissions. – PaulDC Nov 22 '11 at 16:17
Do users need root access? For example to install a package? – SuB Dec 12 '14 at 8:28

Put the A's home directory into a directory for which B has no x (execution) bit set.

Example: Let /home/prison/A be the home directory of A. Set the permissions of prison to r-xr-x--- and the owner:group to root:prisoners. Set the permissions on /home/prison/A normally, i.e. A is the owner.

Naturally, A can still hard-link his files into other directories and make them accessible this way. There is really no way to protect data from users with read access and the will to duplicate them.

share|improve this answer

Thiton's answer is a good way solving this.

Another (heavier and more complex) fix is by creating an appropriate policy if you're using SELinux or AppArmour. You can enforce this at the system level and A won't be able to bypass it on the filesystem level (with AppArmour) or even by copying files (with SELinux).

Implementation of such a policy is left as an exercise to the reader.

share|improve this answer
SELinux, SMACK, or any other MAC framework is the right answer. – ninjalj Nov 22 '11 at 18:43

This sounds like a job for chroot, and someone has a project called jailkit that appears to do just that. Your mileage may vary.

share|improve this answer

If nobody else needs access to files in the users home directory, you could make home directories executable/readable/writable only by that user.

sudo chmod 700 /home/username

Other users will not be able to see inside this directory, cd to it, etc.

share|improve this answer
… until A changes the permissions on the directory. – MikeyB Nov 22 '11 at 17:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.