We have an app testApp. We have a folder called notRestricted in the directory where we run app from. We want to limit access of the app to file system so that app could write only to that folder (we prefer to let it read from anywhere app can normally read from). How to do such thing on Unix?

2 Answers 2


Create a user that's dedicated to running this application. Give this user write permission on the notRestricted directory and nowhere else. Since you don't mind if the application can read from everywhere, you don't need anything more sophisticated.

The application will still be able to write to publicly writable directories: /tmp and /var/tmp on most setups. If this is a problem, set up an access control list on these directories and deny write permission to the application, e.g. on Linux

setfacl -m user:testUser:0 /tmp /var/tmp

Do make sure the user isn't in a group that has write permission to some directory where you don't want the application to write.

  • Grate!)And could you post a command for creating new user not from SU (one to which we give right to write to only that one folder)? meaning that folder is already under some existing user fs how we would create another user not providing him withanething but that folder?
    – Kabumbus
    Jun 16, 2011 at 12:58
  • @Kabumbus: Use useradd, adduser, or whatever utility your unix variant has to create a user. The easiest way to control access to the directory is to make it and its files (but nothing else) owned by a newly created group, and make the new user a member of that group (and no other group). Jun 16, 2011 at 13:59

This is what Gentoo's sandbox system does. It's not particularly well documented, and I'm not sure how difficult it would be to get running on a non-Gentoo system, but it's probably doable.

You can get the current stable version here, and look in etc/sandbox.conf to see how to configure it.

  • So... it is sad "Packages must not achieve this by using sneaky tricks to make sandbox warnings not show up — the sandbox is there to ensure that binary packages will work correctly, and that a badly written Makefile won't cause problems." meaning that sandbox is not really tested for anything that would try to brakeout from it... but I will give it a try=)
    – Kabumbus
    Jun 16, 2011 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .