Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a need to allow directory access to a particular user on my file system. I want this user to be unable to access any other directory in my file system (initially anyway. It may need access to some directories later).

For example: I have a directory called /opt/mydir.

  • I want my dedicated user to only be able to access this directory, and nothing else.
  • I want all other users to be able to access this directory as normal.

I'm new to Unix and its permissions. I've read a fair bit of background material but I'm a little confused. Is there anyway to revoke permissions to /opt/mydir for a single dedicated user?

A possible flawed method would be to only allow access to /opt/mydir and exclude every other user. This won't work because I want all other users to work as normal; accessing the directory.

I'm working on Solaris 10.

Any suggestions are appreciated.

share|improve this question
    
how will the user be accessing the system? ssh? sftp? ftp? or keyboard/monitor? –  Tim Kennedy Nov 15 '11 at 16:20
add comment

2 Answers

You can use a group for this.

Make sure that user is a member of only that group, then change owner of the directories you want him to access to that group, and set appropriate permissions.

If other users need to access those same directories, add them to that special group. Just don't add the restricted user to any of the "usual" groups (like staff or users).

(In other words, you don't revoke access to almost all directories to a user, you grant access only to the subset he is allowed to work in.)

share|improve this answer
add comment

You can look at setfacl, something like

setfacl -r -m youruser:yourgroup:rwx,mask:rwx /opt/mydir

This works on top of the normal directory permissions.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.