Is there any nice single line command to revoke all the user's privileges (read/write permission on each account) except a user executing the command and root? I want this because I want to restrict all the access from all users at specific time point. Of course, I can do this with commands such as chown and chmod, but these commands need to work with each account.(e.g. chmod 000 $FOR_EACH_ACCOUNT)


NOTE: if you are thinking about this because you think your system has been hacked or something else unlawful is going on in it, stop reading this and search using keywords "linux gathering forensic evidence".

There are some special steps you should follow if you need to absolutely "freeze" the state of a system for legally binding evidence, and revoking file permissions is not the right tool for that job.

But if it's something less serious than that, read on...

Instead of modifying file permissions, you probably should think in terms of stopping user sessions and disabling other network services.

Create a file named /etc/nologin and no new logins will be accepted, except by the root user. Then kick out any existing sessions, ideally using the HUP signal so that editors and similar programs get a chance to save their work one last time before dying.

(Otherwise you'll find one of your users had a long-running session and just lost a long document or week's worth of research data, and will be very unhappy with your actions.)

But if you must instantly block all users' write operations, how about remounting the filesystem containing the users' home directories in read-only mode? mount -o remount,ro /home

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.