asumming a system where only 1 new user was added and was given root (administrator) privileges.
we want to keep the user files within the user home directoy safe, meaning the no other user (except root) could access the files\directories.
this can be done using umask, but umask sets the permission globaly on the file system and not only for the user home directory.
we would like to keep the default file and directory permissions out side of the user home directory since the user is used to administer and install executables outside of the user home directory so other user could use it.
could you please advise what is the best parctice to achieve the above?
tl;dr: how to harden the root (administrator) file and directory permission while still letting other access general exeutables installed by the root user.