In my PC, there are two users "root" and "user1". In /home I have a directory for a "user1" /home/user1. Now i want to restrict root user to access /home/user1 directory for read, write and execute. Is it possible ?

How to do this help me? Thanks in advance.

  • If you do not want a user to see your data do not put in on that machine. Use an usb stick you use when you are at the machine and take out whenever you leave it unattended. And even then... that is not 100% guaranteed. "root" can create rules to copy anything you see to a location on the system; just plugging in the USB is enough. Opening "gedit" can be altered to copy the file you start it with to another location. Or when you save from "gedit" the file can be copied. – Rinzwind Jul 5 '17 at 10:23
  • If it is your PC anyway than what do you actually want to archieve with that?? – derHugo Jul 5 '17 at 17:41

No you can't.
Even if you implement some protection, he's the root.. He can revert it.

The only suggestion is: encryption, and if you're logged in he can still see what you got.

| improve this answer | |
  • Thank you for quick reply. which encryption is better choice ? and also i want to access files in that directory from C application also. suggest me . – manikanta Jul 5 '17 at 9:08
  • Depends on what you are trying to achieve ... if it's just a file you care about just encrypt that file, if it's your whole home directory then use things like ecryptfs, for your programming issue you show ask your question at stackoverflow.com. – Ravexina Jul 5 '17 at 9:16
  • encryption is also not going to stop the admin. All I would need to do is create aliases and I can copy anything you touch. And there for me to see the contents. Don't use that machine if you do not trust the admin. – Rinzwind Jul 5 '17 at 10:25

After Research on this, i decided to take the solution as setting the immutable bit to that Directory. Then accidental Deletion can be avoided by any user even root also can't delete the File. But Permanently it is not possible.

chattr +i <filename>

now no one can't delete the file until to reset the immutable bit using the command

chattr -i <filename>

to know the status lsattr command is useful.

Thanks for your Valuable Replies.

| improve this answer | |
  • That's wrong :-) root can remove the immutable bit then removes the file, as I said root can revert everything you do. not to mention to set the immutable bit you have to be the root. – Ravexina Jul 7 '17 at 11:51
  • But this is somewhat near to my requirement. Thanks for your contribution. – manikanta Jul 7 '17 at 11:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.