I am currently making a test environment where users will be going through a network administration course with different levels they must complete. Due to the nature of the course, we want to give them almost root access to machine.
The one exception we want to make is to stop them from being able to access one folder in the machine. This is the folder where we will have programs for the testing environment that checks to see if they have completed the level successfully.
Does anyone have a good way of giving someone basically root access, but restricting one folder? I was messing around with group privileges, and I think that might be the key to what I need.