2

I am looking for a way so that a particular user or a group should not given the permission to remove any file in the system, but only read/execute the file.

8
  • Not the duplicate. I am not asking for certain file, but for the whole system.
    – Harshit
    Oct 14 '15 at 5:35
  • Mount the partition read-only. If that doesn't solve your problem, please elaborate why you want to do this. It appears very strange to me that I can create a file as a user and later when I decide that I no longer need that file I have no right to remove it.
    – Marco
    Oct 14 '15 at 5:36
  • @Marco, There are some users on my system who don't know anything about the PC, so they try to explore it for just learning purpose. My intention is that I can give them a separate account by which they can explore the system without accidently removing or changing any file on the system, but I as another user should be able to do any changes on the system.
    – Harshit
    Oct 14 '15 at 5:45
  • 1
    How are they supposed to learn when they can't edit their .bashrc customize their programs, create cron jobs, etc? The solution is to provide the users with a facility to restore to an older working state (e.g. by using snapshots) when they messed something up. Document how the restore process works (e.g. a small howto) and they can mess with their files as they please and learn a lot without bothering you. Crippling the system is the wrong approach IMO.
    – Marco
    Oct 14 '15 at 5:51
7

There are some users on my system who don't know anything about the PC, so they try to explore it for just learning purpose. My intention is that I can give them a separate account by which they can explore the system without accidently removing or changing any file on the system, but I as another user should be able to do any changes on the system.

That is the roughly way a Unix/Linux system normally works. A user only has the right to delete or modify (a) files or directories that he owns or (b) files or directories for which a group that he is in has write permission.

The system administrator (that's you, I presume) has control over everything. So, just make sure that these new users are in their own individual group.

Unix was designed to be a multi-user system. So, from the start, Unix/Linux give normal users only only limited permissions. Generally, no normal user can mess with system files. Only the system administrator, called root, can do that.

Some systems allow normal users to get root's capabilities by running sudo. Make sure that your /etc/sudoers file does not give that capability to them.

If you want to be severe, do not give them ownership even of a home directory. They would still have write permission to /tmp and /var/tmp but that shouldn't cause trouble unless they create files so big that they fill up the partition.

1
  • Thanks for your answer, now I got the path to where I should move on.
    – Harshit
    Oct 14 '15 at 6:21
2

After seeing your requirement , you can use the setfacl tool to restrict the access for some important files/directory(such as /etc, /lib, /bin). So that new users will not be able to delete or modify any important system file .

Command :

setfacl -m u:{user_name}:{permission} {file/directory} 

Restricting a learner from their home directory is not a good idea .

1
  • 6
    Important system file are read-only for regular users anyway so by default users can't modify an important system file, only their own files. So I don't know how this answers the question.
    – Marco
    Oct 14 '15 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.