This question already has an answer here:
- How can I lock down ubuntu? 5 answers
I need to prevent/restrict standard users from accessing directory like bin,boot,dev,etc,lib,media?
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
If from a terminal CTRL+ALT+T you enter the following command
You should see something like this
List cut short
This shows that all the directories are already restricted. Lets take an example.
The first bit
The first character
The next 3 characters
The next three are for members of the group in this case
The final three characters are for everyone else in this case
In the case of a directory
For the directories you are asking about normal users are already restricted to read and execute.
If you want to change these permissions you can use the
But as pointed out by bodi.zazen It's not recommended for system directories and files.
You can not really restrict users from those directories as they need access to the libraries and binaries, /bin/bash for example.
IMO you have two ways to restrict users access.
The first is with standard permissions. In general, however, it is a very bad idea to start using
The reason is that all users will need to access the binaries and libs such as
If you need to restrict uses beyond the standard permissions, then use apparmor.
An easy way of using apparmor is to use the guest account. If you need restriction beyond that you would have to write your own profile, as a template, use this template:
You need to have a firm understanding of system files and what you need to allow and restrict.
Alternately you can use tools such as LXC or chroot jails, but, IMO, they are no easier to configure, require a bit more maintenance, and are less secure (it is hard to break out of Apparmor, easier to break out of a jail).