Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my Linux system I have two users, say A and B. I need to isolate B in such a way that B cannot be given access to A's home directory,even by A itself. How can I solve the issue?

share|improve this question

migrated from stackoverflow.com Nov 22 '11 at 16:38

This question came from our site for professional and enthusiast programmers.

    
can you explain "B cannot be given access to A's home directory,even by A itself." in more detail? btw, maybe you want to work on your accept rate a little bit. –  Kent Nov 22 '11 at 16:11
    
Yes! B should be denied access from A's home directory even if A intents to do so by changing permissions. –  PaulDC Nov 22 '11 at 16:17

4 Answers 4

Put the A's home directory into a directory for which B has no x (execution) bit set.

Example: Let /home/prison/A be the home directory of A. Set the permissions of prison to r-xr-x--- and the owner:group to root:prisoners. Set the permissions on /home/prison/A normally, i.e. A is the owner.

Naturally, A can still hard-link his files into other directories and make them accessible this way. There is really no way to protect data from users with read access and the will to duplicate them.

share|improve this answer

Thiton's answer is a good way solving this.

Another (heavier and more complex) fix is by creating an appropriate policy if you're using SELinux or AppArmour. You can enforce this at the system level and A won't be able to bypass it on the filesystem level (with AppArmour) or even by copying files (with SELinux).

Implementation of such a policy is left as an exercise to the reader.

share|improve this answer
    
SELinux, SMACK, or any other MAC framework is the right answer. –  ninjalj Nov 22 '11 at 18:43

This sounds like a job for chroot, and someone has a project called jailkit that appears to do just that. Your mileage may vary.

share|improve this answer

If nobody else needs access to files in the users home directory, you could make home directories executable/readable/writable only by that user.

sudo chmod 700 /home/username

Other users will not be able to see inside this directory, cd to it, etc.

share|improve this answer
    
… until A changes the permissions on the directory. –  MikeyB Nov 22 '11 at 17:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.