Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to restrict an application being opened under ordinary privileges. Only root shall run the application, so that contents wont be seen by others and they wont change anything.

share|improve this question
@VRU I am not sure your link is a duplicate. – don.joey Jan 25 '13 at 13:25
@VRU Since you can't dupe acros sites, we can definitely use a Q&A on this (unless we declare this off-topic, which I wouldn't). – user98085 Jan 25 '13 at 13:34
@GKUTTY for your reference… – VRU Jan 25 '13 at 18:35

There should be a better way to do this (maybe with AppArmor?) but you can always change the permissions of the executable. Suppose you want to disable access to nano. Their default permissions are as follows:

 ➜  ls -la /bin/nano
-rwxr-xr-x 1 root root 192008 Oct  1 15:12 /bin/nano

It can be executed by owner, group and others. To maintain only owner execution you can use

sudo chmod g-x /bin/nano
sudo chmod o-x /bin/nano

After this, if you execute it in a terminal as an ordinary user:

 ➜  nano
bash: /usr/bin/nano: Permission denied

Please note that this is not a bullet-proof solution. If the application you want to lock has other entry points they could still be accessed. For example, if you tried the same trick with Firefox:

 ➜  ls -la /usr/bin/firefox
lrwxrwxrwx 1 root root 25 Jan 17 08:26 /usr/bin/firefox -> ../lib/firefox/

Even if you limited access to /usr/bin/firefox, as it is just a link to /usr/lib/firefox/ it could be still be executed by there (or using /usr/lib/firefox/firefox, which is used in the .sh file).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.