I want to create a user in such a way that he/she cannot execute any file

I'm using Ubuntu 11.10


I tried chmod 700 /bin/sh + /bin/chmod as root

in this way is there any way or any possibility that users can execute files ?

Can anyone provide me some step-by-step instructions please?

  • 2 answers has been tested > non worked – One Zero Jan 9 '12 at 8:59

Set the umask property of the user to 113.

The user file-creation mode mask (umask) is use to determine the file permission for newly created files. It can be used to control the default file permission for new files. It is a four-digit octal number. A umask can be set or expressed using Octal values

Calculate umask for any user as follows :

The octal umasks are calculated via the bitwise AND of the unary complement of the argument using bitwise NOT. The octal notations are as follows:

Octal value : Permission
0 : read, write and execute
1 : read and write
2 : read and execute
3 : read only
4 : write and execute
5 : write only
6 : execute only
7 : no permissions

if you want to restrict your newly created user from executing any file, set his umask to 113( it means he can only read and write the file, his group can only read and write the file while anybody else can only read the file)

The default umask of any user in linux is 002 and for root user is 022.

You can default umask for any user like this: 1) open /etc/profile 2) modify the following line "umask 022" according to the default permissions you want to give to your user.

Check the man page of umask for further reference

man umask
  • Users will retain right to chmod their files, so they'll be able to change permissions to executable. I don't think it is an option here. – korjjj Jan 9 '12 at 7:46
  • This is the permissions of chmod command ls -al /bin/chmod -rwxr-xr-x 1 root root 42588 /bin/chmod you can restrict other users from executing it. by changing permissions of chmod command :) – Rajesh Pantula Jan 9 '12 at 7:52
  • u can do sh script .. not working – One Zero Jan 9 '12 at 8:43
  • chmod 700 /bin/sh + /bin/chmod as root – One Zero Jan 9 '12 at 8:47

One way of doing something like that will be to mount separate filesystem in noexec as user(s) homedir:

Create a file image (512M) with ext4 filesystem on it:

~# dd if=/dev/zero of=/var/homedir_image seek=512 count=512 bs=1M

~# mkfs.ext4 /var/homedir_image

Then add it to /etc/fstab with noexec option:

/var/homedir_image /home/user ext4 noexec,loop 0 2

Then mount that image in future user's dir:

~# mkdir /home/user && mount /home/user

And create required user:

~# adduser --home /home/user user

User will be able to create files with x permission, but will not be able to execute anything located on his homedir filesystem.

  • The part with file image is optional, of course, as You just can use separate disk partition. – korjjj Jan 9 '12 at 7:09
  • user1@ubuntu:~$ mkdir 123 mkdir: cannot create directory `123': Permission denied user1@ubuntu:~$ pwd /home/user1 – One Zero Jan 9 '12 at 8:18
  • i did the same thing ..the thing is that user1 cannot even create a folder – One Zero Jan 9 '12 at 8:20
  • Oh, forgot to mention that You should change user's folder ownership, as it is likely owned by root by now. chown -R user1:user1 /home/user1 – korjjj Jan 9 '12 at 8:48
  • chown user1 ...it worked but still user can execute file – One Zero Jan 9 '12 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.