Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Fedora 15 installed on my VPS, and I want to create a user who can only view all files on the system but may only write to its own home folder.

Thank you

share|improve this question

migrated from stackoverflow.com Sep 10 '12 at 2:52

This question came from our site for professional and enthusiast programmers.

    
That describes any user you might create. What is wrong with adding a user in the normal way? –  Michael Hampton Sep 10 '12 at 2:56

1 Answer 1

I don't know anything about Fedora, but in Unix / Linux, there are only very few directory in general which are group or world writable. The only thing I could really think of at the moment is tmp.

You could run something like find -x / -type d -perm +go+w (do this for each of your mounted file systems) to find any directory that's group or world writable.

In theory, you could modify the permissions of /tmp, then set the TEMP environment variable in the users's ~/.profile. However, you need to be careful not to break any system services which drop privileges, stuff like apache, squid, postfix, etc.

To get that right, you'd have to change the group of /tmp to something like wheel, then make sure all of the "system daemon users" are in that group (look in /etc/group for accounts with low user-ids, such as lp, postfix, wwwrun, etc.) Some of these may use their own temporary directory, but I'm not sure whether that applies to all accounts.

I also don't understand why you want to limit writes if that user can still read everything.

Modern Operating Systems (Linux, Mac OS, Windows, etc.) are designed in a way that non-admin users generally can't break anything by writing outside their home directories.

If you're worried about file system usage, either put stuff like /tmp onto a separate partition or use disk quotas.

So I can't give you a definite answer on whether or not it's possible to prevent a user from writing outside his home directory - but there's a decent change that you're breaking more than it helps.

share|improve this answer
    
If you believe that "modern OS" that non-admins can't break much, then as a learning experience, I'd suggest deploying public Ubuntu workstations. We deployed 24 of them in a social service setting. I think it took 36 hours before 7 of them wouldn't even boot anymore. Users CAN and generally WILL break them in very unpleasant and unexpected ways. At least XP machines with SteadyState last a solid 6 weeks on average before they need serious maintenance. –  Magellan Oct 3 '12 at 6:21
    
Omg, that sounds horrible! Well, I must admit, I'm mostly a Windows / Mac person these days and it has been about a decade since I last administered linux servers in a multi-user environment. Maybe today's Linux'es really have deteriorated a lot over the years. In a perfect world, a unix-based system really shouldn't give a non-root user much room to really break it. –  Martin Baulig Oct 3 '12 at 7:17
    
Amen. Ubuntu is turning into the Windows ME of Linux. Or maybe Microsoft Bob. –  Magellan Oct 3 '12 at 7:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.