Say I run a program like so:

cd foo && program x y z

How can I give program access to only the directories in foo and below?

Pretend my fs looks like:


if I run program in the foo/ dir, it obviously shouldn't have access to what's in bar/ or baz/, etc.

NOTE: My distro is Ubuntu 16.04 if that makes any difference.


This seems like a good answer: https://unix.stackexchange.com/a/384120/113238

so we'd do something like this:

chown app1 /var/lib/myapps/app1
chmod 700 /var/lib/myapps/app1
sudo -u app1 /var/lib/myapps/app1/run.sh

however, I'd to find a solution that does not require sudo.

  • This does not stop the application from accessing (reading) files elsewhere on the system. It only provides a directory that the application can write to, in a fashion very similar to how most daemons are running under special system accounts on most modern Unices. – Kusalananda Jul 12 '18 at 7:03
  • ok I am just looking for answers to the OP that are reasonable, I don't think it should be so hard to find one but it is – Alexander Mills Jul 12 '18 at 7:13
  • This is usually what a chroot is for, executing a process with a displaced root directory. – Kusalananda Jul 12 '18 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.