Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The default guest user can't read the home directory and its contents, but it can read the root directory and other directories with the same permissions as home. So, where is this particular limitation specified?

share|improve this question
Guest is not a normal user, it's a special session with specific parameters such as not saving data, and having limited access. It was designed to mainly allow a laptop owner to let someone use his computer to do something like check an email account. – Marty Fried May 2 '12 at 20:37
Yes, thank you, I understand what is it designed for. But why it can read other directories and not the home. I ma not asking for the purpose but the technical reason. – Pili May 2 '12 at 20:42
My point was that it's a special session, so it doesn't need to use normal Linux permissions. If you wanted, you could set up a guest account yourself, using normal specifications like groups, ownership, permissions, etc. But this doesn't do that, and is not something that you can modify easily in the normal way. I'd imagine it could be done, but sorry, I'm not interested enough to try. – Marty Fried May 3 '12 at 4:44
This seems like an atrocity of the *nix way, IMO. Things are designed to be compartmentalized and universal. What happens when you run whoami while logged in as guest? – Huckle May 3 '12 at 16:38
@MartyFried do you have any source to back your statement ("it doesn't need to use normal Linux permissions")? – guntbert May 10 '13 at 19:50

The package used to handle the restricted permissions for the guest session is AppArmor.

AppArmor is a Linux Security Module implementation of name-based mandatory access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities.

(From the Ubuntu Server Guide)

It utilizes so called "profiles" to permit/deny access to files/directories, the network,...

Those profiles are stored under etc/apparmor.d/, the one responsible for the guest user in newer releases (after the switch to lightdm as display manager) is lightdm-guest-session. Everything within the guest session is handled by /usr/lib/lightdm/lightdm/lightdm-guest-session-wrapper, which is a binary file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.