0

I have a need to allow directory access to a particular user on my file system. I want this user to be unable to access any other directory in my file system (initially anyway. It may need access to some directories later).

For example: I have a directory called /opt/mydir. - I want my dedicated user to only be able to access this directory, and nothing else. - I want all other users to be able to access this directory as normal.

I'm new to Linux and its permissions. I've read a fair bit of background material but I'm a little confused. Is there anyway to revoke permissions to /opt/mydir for a single dedicated user?

A possible flawed method would be to only allow access to /opt/mydir and exclude every other user. This won't work because I want all other users to work as normal; accessing the directory.

I'm working on Solaris 10.

Any suggestions are appreciated.

@Chris: The chroot seems to be a solution to my problem.

I am currently working on Solaris 10. The syntax for chroot oon this OS is: /usr/sbin/chroot newroot command

Do you know what the 'command' would be in my situation solution? The documentation is very vague.

What I think should happen is I:

  1. Create a fake root for my application say /opt/myapproot.
  2. I then do 'chroot /opt/myapproot' to make /opt/myapproot look like '/'.
  3. I then can run my application in this 'jail', restricting it from any dir above /opt/myapproot.

Does that sound correct?

Improve this question
1
  • Are you expecting to provide your users with an interactive shell? If so I've pointed to some additional resources below. I expect if you're providing access to more complex tools or environment, then setting up a jail may be difficult. I couldn't find Solaris 10 specific resources, sorry.
    – Chris W. Rea
    Nov 16, 2011 at 19:03

1 Answer 1

Reset to default
1

Re:

I want this user to be unable to access any other directory in my file system [...]

To truly restrict a user to not access anything else in your filesystem, one technique to consider is a chroot jail, which would limit the user to access only the files contained in the chroot'd folder.

However, you'd need to also copy some essential system files into the jail folder, in order for the user to be able to perform whatever limited commands you would permit (after some more thoughtful consideration), because a user in a chroot jail would not even have read access to places in the filesystem you might be taking for granted, such as /bin, /etc, /usr, and so forth.

Or perhaps you didn't really mean to say "... unable to access any other directory ... ". :-)

Additional resources:

Improve this answer

You must log in to answer this question.