Say I run a program like so:

cd foo && program x y z

How can I give program access to only the directories in foo and below?

Pretend my fs looks like:


if I run program in the foo/ dir, it obviously shouldn't have access to what's in bar/ or baz/, etc.

NOTE: My distro is Ubuntu 16.04 if that makes any difference.


This seems like a good answer: https://unix.stackexchange.com/a/384120/113238

so we'd do something like this:

chown app1 /var/lib/myapps/app1
chmod 700 /var/lib/myapps/app1
sudo -u app1 /var/lib/myapps/app1/run.sh

however, I'd to find a solution that does not require sudo.

  • This does not stop the application from accessing (reading) files elsewhere on the system. It only provides a directory that the application can write to, in a fashion very similar to how most daemons are running under special system accounts on most modern Unices. – Kusalananda Jul 12 '18 at 7:03
  • ok I am just looking for answers to the OP that are reasonable, I don't think it should be so hard to find one but it is – Alexander Mills Jul 12 '18 at 7:13
  • This is usually what a chroot is for, executing a process with a displaced root directory. – Kusalananda Jul 12 '18 at 7:25

Your Answer

