You need to use the
- Create a special user owning the software "foo-user"
- Install the software and change the owner of the files to "foo-user", remove group and other user's privileges to the files (
- Add users to
/etc/sudoers that will be able to run the software:
user (ALL)=(foo-user) /path/to/software
- Either instruct users to use
sudo -u foo-user /path/to/software for running it, or prepare
.desktop files for them.
The downside is that the
foo-user needs to be able to access the
user home directory for
user to be able to edit his/her own files. If you have multiple users that need access to software it may be a problem.
Also, if the software in question has any advanced file-management functionality it may be possible to use it to copy its own files out of the restricted folder.
umask should prevent it, but then editing files will be more problematic.
For GUI apps you may use