Re: [gentoo-user] Creating a restricted user

[Mick]

On Wednesday 12 December 2007, Dirk Heinrichs wrote:
> Am Mittwoch, 12. Dezember 2007 schrieb Grant:

> > I've noticed when adding this kind of a user in the past they are able to
> > look at files all around the system that I'd prefer they can't.
>
> Why? System directories look nearly the same on any Linux system, so it
> doesn't really make sense to restrict read access to them. For other,
> private directories you could take away permissions for "others" (i.e.
> chmod 750 mydir) and in addition _don't_ put that user in the users group,
> or use ACLs for more fine grained access control (see man getfacl, man
> setfacl).

Only to add to the above that as an alternative to having a users group for 
all your users you can instead create a <user_name> group for each user_name.  
This way you isolate your users from each other as long as the 
user_name:users ownerships become user_name:user_name.
-- 
Regards,
Mick