I would like to prevent my root user from running certain applications that can change the permissions of files which in turn prevents normal users from running those applications again.

for example, if i sudo to root, and then run thunderbird from the command prompt, it changes the permissions of files within my home dir / profile so i can no longer run it as a normal user; what i would like to do is prevent root from running thunderbird and hence stop this user error from repeating itself.

any suggestions?

to clarify,

if i have a lot of administration to do i use "sudo -s" which gives me a root shell, its just once a year or so, i shoot myself in the foot.

  • 2
    "if I sudo to root" does this mean that you are typing sudo thunderbird or you are logging in as a root user then starting thunderbird? – TrailRider Nov 14 '12 at 2:56
  • 1
    Why would you ever run Thunderbird as root? – mikewhatever Nov 14 '12 at 3:20
  • good question @mikewhatever , I was wondering the same myself..... – TrailRider Nov 14 '12 at 3:25
  • i use sudo -s, when i have a long series of commands, its a bad habit i know. ... and no i cant think of any reason why you would run thunderbird as root, so i wanted a technique to stop myself from doing it by accident. – joe Lovick Nov 14 '12 at 4:21
  • What you are basically asking is "How to protect a system from its administrator", which is not something Linux is very good at. Root access is necessary and useful (not a bad habbit at all), but you can't avoid having to learn how to use it. – mikewhatever Nov 14 '12 at 4:54

If you have thunderbird installed locally, somewhere in your home directory then you could change the permissions to 500 so that only you can execute that program.

Run this on the executable

chmod 500 thunderbird

Also as TrailRider has said, don't run programs by prefixing sudo, it can be potentially dangerous. You can fix the permissions by changing the ownership of the thunderbird directory to your user name.

  • will permission 500 stop a sudo command from working? What about a user logged in as a super user? I thought that administrator accounts could override the permissions? – TrailRider Nov 14 '12 at 3:33
  • The administrator should be able to change permissions. – nikhil Nov 14 '12 at 3:42
  • ok that's what I thought, thanks for the clarification... – TrailRider Nov 14 '12 at 3:43
  • Not sure how this got to be accepted. This literally doesn't work. root can run any program that has any execute bit set. – Joshua Aug 13 at 19:36

I believe as this is a case of stopping a bone headed user shoot them selves in the foot that there is no easy way to do this. with great power comes great responability, and it would probably be best if learnt not to use sudo -s quite so often.

that being said, i am going to wrap a bash script around thunderbird, that checks the user name using whoami or $SUDO_USER and then aborts if it is an administrator. its not a general solution, but it will help in this isolated case.


I have the habit of opening an extra session for root access with sudo su - and with a conspicuous prompt. This stops me from doing stupid things with sudo.


Open up the program's source code, find main(), add the lines

if (geteuid() == 0) {
    fprintf(stderr, "Access by root is disabled.\n");

recompile and install.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.