add user, and set user privileges, setting file permissions block certain commands?

Question

I am wanting to make restricted user for a friend on my raspberry pi, I know how to add a user, but I never looked at adding restrictions to that user.. I tried googling but it seems its not a common topic.

How would I go about that?

Edit; The restrictions I had in mind were that he can only read certain files and execute certain files he won't be able to enter my directory (cd /home/pi/) and mess with the files. He wouldn't be able to make his own files or remove files (he is kind of new and I don't want him messing with those commands yet and mess something up we all know how scary rm can be.)

Answer 1

What sort of restrictions do you have in mind? By default any user on a Linux system is pretty restricted already. They can usually only edit their home folder (e.g. /home/pi/) and run applications. They may be able to browser other home directories though. You can avoid this by removing read and execute (cd) permissions for 'others'. chmod o-rx /home/pi.

Then there's the sudo command. On the Pi it's setup so that you don't have to enter a password to use it as the pi, but that's not normally the case. Any other user added to the system won't have this ability. If you ensure that they aren't in the sudo group, they won't be able to use the sudo command at all.

If they log in over SSH, by default they also won't have permission to access the display of the Pi, so you don't have to worry about them starting the GUI for example.

I think those are probably the big things to worry about.

Answer 2

That depends on what restrictions you want to give them. Simply not giving the new user account sudo privileges will keep them from performing administrative actions (eg. they can only mess up their own piece of the filesystem).