Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to add a user and restrict him to run special programs?
For example after this user logs in, he can only open Firefox to use Internet and no other programs can be run by this user.
For example in a terminal, commands will not be accessible when you delete some environment variables like $HOME.
But is it possible to avoid running programs in a graphical shell, like Gnome? If yes, how?

share|improve this question
This is typically referred to as kiosk mode but i am not sure about the state in gnome 3. See tranzistors.wordpress.com/2012/05/23/… for more details. According to fedoraproject.org/wiki/Features/InitialExperience gnome-shell has some kind of kiosk mode – Ulrich Dangel Jul 7 '12 at 21:13

You can remove execute permissions for the binaries you don't want the user to run. Create a new group, change the execute permissions (chmod go-rwx), and add the desired user to the group. (This is similar to how only certain users are allowed to use the sudo command.)

Depending on what you want to achieve, chroot jail might also be useful. In case you're planning to have a kiosk-like setup, there are lockdown tools for both KDE (Kiosk Tool) and GNOME (Sabayon). If Firefox is all you want to allow, check out Webconverger. In case you're planning to set up a kiosk network, google Libki. If security is paramount, you can also refine the capabilities of individual programs using AppArmor or SELinux.

share|improve this answer
I'm not adding this as an answer because I haven't tried it in a long time, but you can change the user's login shell (in /etc/passwd, I believe) to run an arbitrary command or script instead of the default that allows them full normal user access. You just have to test your command/script to make sure the user can't break out of it. – Joe Jul 14 '12 at 20:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.