Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

13
  • 1
    @planetmaker no! You'll either break the entire system or else break distribution upgrades. Commented Mar 5, 2020 at 7:49
  • 4
    That implies user guest won't even have a shell to start, because /usr/bin and /bin are identical in many modern distros. (My gut feeling would be to try and put them in a chroot jail; it's possible that systemd even gives you nice automatisms for that, like it does for services.) Commented Mar 5, 2020 at 8:42
  • 3
    I'd implement this with a PAM module that does a bind mount of /var/empty over /usr/bin in a private filesystem namespace during login for the relevant user. Why do something that modifies the filesystem for everyone, when you can modify the filesystem only for the one user? Commented Mar 5, 2020 at 17:38
  • 1
    See ibm.com/developerworks/library/l-mount-namespaces/index.html discussing a (different) private-namespace PAM module's implementation. Commented Mar 5, 2020 at 17:40
  • 3
    Just a heads up, but permissions are defined with 4 octal digits, not 3. You might be thinking that all your files are 755, but I have many that are 4755, 2755, 6755, etc. 750 is the same as 0750, so by changing them all to 750, you might be breaking quite a few executables (like sudo) by clearing their suid, sgid, and sticky bits. Commented Mar 5, 2020 at 20:02