Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an app testApp. We have a folder called notRestricted in the directory where we run app from. We want to limit access of the app to file system so that app could write only to that folder (we prefer to let it read from anywhere app can normally read from). How to do such thing on Unix?

share|improve this question

Create a user that's dedicated to running this application. Give this user write permission on the notRestricted directory and nowhere else. Since you don't mind if the application can read from everywhere, you don't need anything more sophisticated.

The application will still be able to write to publicly writable directories: /tmp and /var/tmp on most setups. If this is a problem, set up an access control list on these directories and deny write permission to the application, e.g. on Linux

setfacl -m user:testUser:0 /tmp /var/tmp

Do make sure the user isn't in a group that has write permission to some directory where you don't want the application to write.

share|improve this answer
Grate!)And could you post a command for creating new user not from SU (one to which we give right to write to only that one folder)? meaning that folder is already under some existing user fs how we would create another user not providing him withanething but that folder? – Kabumbus Jun 16 '11 at 12:58
@Kabumbus: Use useradd, adduser, or whatever utility your unix variant has to create a user. The easiest way to control access to the directory is to make it and its files (but nothing else) owned by a newly created group, and make the new user a member of that group (and no other group). – Gilles Jun 16 '11 at 13:59

This is what Gentoo's sandbox system does. It's not particularly well documented, and I'm not sure how difficult it would be to get running on a non-Gentoo system, but it's probably doable.

You can get the current stable version here, and look in etc/sandbox.conf to see how to configure it.

share|improve this answer
So... it is sad "Packages must not achieve this by using sneaky tricks to make sandbox warnings not show up — the sandbox is there to ensure that binary packages will work correctly, and that a badly written Makefile won't cause problems." meaning that sandbox is not really tested for anything that would try to brakeout from it... but I will give it a try=) – Kabumbus Jun 16 '11 at 13:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.