I'm trying to create a restricted shell for a maintenance user. This user should only be allowed to execute a single bash script within his home folder.

The user should not be allowed to execute any other command or even change the folder. This should work for both SSH and for a normal terminal login directly on the system.

I'm trying to set up this on a Fedora AtomicHost OS. IMHO the best way to do this is by using chroot. But I'm running into some issues, because /bin/su is not working within the chroot environment.

Is there any alternative to chroot?

  • 2
    Couldn't you just set the script as the login shell for the user? That would execute the script upon logging in, and the user would be logged out when the script exits.
    – Kusalananda
    Commented Aug 30, 2018 at 8:42
  • @Kusalananda Or even better - set as shell some wrapping script that hold the stdout for user until any key will be pressed.
    – Kondybas
    Commented Aug 30, 2018 at 8:50
  • @Kondybas Something like that maybe, yes. There's no real point in handing the user a shell prompt if the only thing they're allowed to do is to run a single script.
    – Kusalananda
    Commented Aug 30, 2018 at 8:51
  • At least for debug purposes because script set as shell will be executed in the specific environment.
    – Kondybas
    Commented Aug 30, 2018 at 8:53

1 Answer 1


You can set the Bash script as the user's shell:

chsh -s /path/to/script.sh -u maintenanceuser

Just double-check that the user won't be able to exit the script and gain access to a shell.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .