I have a need to allow directory access to a particular user on my file system. I want this user to be unable to access any other directory in my file system (initially anyway. It may need access to some directories later).

For example: I have a directory called /opt/mydir.

  • I want my dedicated user to only be able to access this directory, and nothing else.
  • I want all other users to be able to access this directory as normal.

I'm new to Unix and its permissions. I've read a fair bit of background material but I'm a little confused. Is there anyway to revoke permissions to /opt/mydir for a single dedicated user?

A possible flawed method would be to only allow access to /opt/mydir and exclude every other user. This won't work because I want all other users to work as normal; accessing the directory.

I'm working on Solaris 10.

Any suggestions are appreciated.

  • how will the user be accessing the system? ssh? sftp? ftp? or keyboard/monitor? Nov 15, 2011 at 16:20
  • You say “revoke access”, then you say “able to access”. Which is it? Jul 21, 2014 at 15:56

2 Answers 2


You can use a group for this.

Make sure that user is a member of only that group, then change owner of the directories you want him to access to that group, and set appropriate permissions.

If other users need to access those same directories, add them to that special group. Just don't add the restricted user to any of the "usual" groups (like staff or users).

(In other words, you don't revoke access to almost all directories to a user, you grant access only to the subset he is allowed to work in.)


You can look at setfacl, something like

setfacl -r -m youruser:yourgroup:rwx,mask:rwx /opt/mydir

This works on top of the normal directory permissions.

  • setfacl does not have a -r option. Do you mean -R (recursive)? Jul 21, 2014 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.