I understand the concept of managing permissions on Linux with
chmod using the first digit as the user, the second as the group and the third as other users as described on this answer in Understanding UNIX permissions and file types.
Let's say I have a Linux system with 5 users:
guest. By default, the users
userc will have execution permission on all files inside
/usr/bin, so these users can use the command line of the system executing the files in there as those files have 755 permission. So far it's completely ok. However, I'd like to forbid the user
guest from executing files on the folder
/usr/bin, I know I could achieve that by changing the permission of all files inside this folder to something like 750 with
chmod, but if I do that I'll mess up the permissions of the users
userc because they will be also forbidden to execute files.
On my computer, all the files in
/usr/bin belong to the group
root, so I know I could create a
newgroup, change the group of all those files to it and add
newgroup. But doing that sounds like way too much modification on the system's default settings. Does anyone know a smarter way of solving this problem?
How can I forbid a single user from using the command line (or executing any file on
PATH) without an overcomplicated solution that requires changing the permissions of too many files?