Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have a user that is able to go in /etc and read files like httpd.conf.

I would like to deny that user access to any critical locations such as /etc, /var and so on.

What would be the best way to do so? I don't really want to modify my whole folder/file permission just for one user.

share|improve this question
up vote 3 down vote accepted

You might want to set up a chroot jail look at Jailkit.

The jail ch anges the root, as in /, to new path.

As a simple example as a start.

First off you would most likely want to have chroot directory on a separate partition - such that the user can't fill your system partition.

But for sake of simplicity:

  1. Make chroot directory:

    # mkdir /usr/chroot_test
    # cd /usr/chroot_test
  2. Make system directories:

    # mkdir bin etc home lib var
  3. Add some basic tools:

Here one can use ldd to find dependencies.

# ldd /bin/bash
linux-gate.so.1 =>  (0xb774d000)
libtinfo.so.5 => /lib/libtinfo.so.5 (0xb770a000)
libdl.so.2 => /lib/libdl.so.2 (0xb7705000)
libc.so.6 => /lib/libc.so.6 (0xb755a000)
/lib/ld-linux.so.2 (0xb774e000)

Copy them to chroot's lib:

# cp /lib/{libtinfo.so.5,libdl.so.2,libc.so.6,ld-linux.so.2} lib/

Now enter chroot

# chroot /usr/chroot_test
bash-4.2# ls
bash: ls: command not found
bash-4.2# pwd
bash-4.2# exit

OK. Works. Add some more tools:

# sed '/=>/!d;/=>\s*(/d;s/.*=>\s*\([^ ]*\) .*/\1/' < <(ldd /bin/{ls,cat,vi}) | sort -u)

... copy


Then add chroot login (http://kegel.com/crosstool/current/doc/chroot-login-howto.html).

But, as mentioned, by using jailkit this can be simplified: http://olivier.sessink.nl/jailkit/howtos_chroot_shell.html.

share|improve this answer

You can use File access control Lists to remove permissions from specific users. The command is setfacl, which Sets (Creates) an ACL on a File.

Example usage:

root@host:/tmp# date > f1
root@host:/tmp# ls -l f1
-rw-r--r-- 1 root root           30 Mar 28 12:12 f1
root@host:/tmp# setfacl -m u:johan:0 f1
root@host:/tmp# ls -l f1
-rw-r--r--+ 1 root root          30 Mar 28 12:12 f1

Notice the + symbol after the permissions. It tells you the file have an ACL set. The setfacl command option -m tells it to create/modify an ACL. The argument "u:johan:0" causes the User Entry for user "johan" to be set to "0", which is an abbreviation for permissions mode "0 0 0", equivalent to "--- --- ---" for the traditional "rwx rwx rwx" permission sets.

root@host:/tmp# getfacl f1
# file: f1
# owner: root
# group: root

root@host:/tmp# cat f1
Thu Mar 28 12:12:07 SAST 2013
root@host:/tmp# exit

After Exit the commands have the permissions of the specified user, eg "johan"

johan@host:/tmp> cat f1
cat: f1: Permission denied

Now having said all of that be very careful. Indiscriminately removing access from /etc WILL cause all kinds of failures and users will likely not be able to log in. Many system functions read, with the permissions of the logged in user, various configuration files in /etc. However preventing users access from specific individual files is perfectly acceptable.

share|improve this answer

The files you are so worried about are meant to be publicly accessible. The really sensitive data is locked away. Yes, Unix is (by design and history) a rather open system.

If you are so worried about that user, just lock her out. A user that you don't trust has no place on your machines.

Or go check with your paranoidist, perhaps it is getting out of control.

share|improve this answer
Yes, thanks for the very helpful comments. I just wanted my allowed SSH login to not be able to read important files like Apache configs, if some how it DOES get hacked into. However, you're right, let's not worry about that because extra security is not important at all. – user2205928 Mar 30 '13 at 1:46

protected by Community Nov 19 '14 at 12:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.