I want to limit certain users on my system to a subset of commands and have absolutely no access to the rest of the system. I figure chrooting is the way to solve this but I only know how to chroot a ftp user. Can this be done for normal shell users and how can I achieve this?
Jailkit simplifies it.
Jailkit is a set of utilities to limit user accounts to specific files using chroot() and or specific commands. Setting up a chroot shell, a shell limited to some specific command, or a daemon inside a chroot jail is a lot easier and can be automated using these utilities.
Please use chroot with extreme caution, it's well known that it doesn't provide the complete protection it seems to.
I remember a debate on the LKML about fixing "bugs" in chroot that allowed users to escape; kernel developers have answered that chroot is not intended to be a security mechanism.