将linux用户限制为一个文件夹

Question

I need to create a seperate folder for an user where he is allowed to execute only one binary. He can call python/perl and run a program also. But the user should not be able to delete any folder in his directory and should not be able to view any other directory. How can i achieve this ?

Answer 1

If they are accessing only over ssh, then a ChrootDirectory is the way to go. Simply put, you create a fake / system in another directory, with all the programs the user is allowed to run & the libraries they need.

See the ChrootDirectory section of the sshd_config man page, or somewhere like Here for a fuller guide if needed.

Answer 2

CHMOD does the job

  chmod 755 directory/filename

7 user (**owner**) has full access.
5 allows **group** user "read" and "execute" permissions, but
  not "write" permissions. 
5 allows **others** "read" and "execute" permissions, 
  but not "write" permissions.     

For your reference :

The 5 allows "read" and "execute" permissions, but not "write" permissions. A 6 would allow read and write permissions, but not "execute". A 4 would be "read" only. A 2 would be "write" only, and a 1 would be "execute" only.

Further Reference : link

Answer 3

You could also consider configuring and using a restricted shell like eg a restricted bash .

However, notice that if you enable the user to run a scripting language like Python he will be able to circumvent these restrictions (using some clever scripts). So a chroot is probably preferable.

You could define a separate group for that user to refrain him from doing a lot more. See also the nobody username , SELinux , etc.