I don't know why you would need an "untrusted" group if you only have one "guest" (and you should only have one guest, usually). The group "guest" can be used as "untrusted" would. Anyway, I'll try to be brief with an explanation to point you in the right direction:
??? (did I do the above so far correctly???) --I still want other
super users to be able to see guest's files.
Anyone who's logged into the account "root" can do this. Either use su -c "do something" or sudo do something. To login as root, use su root (or just su as it defaults to root with no args) or sudo -i (but know that logging in as root is discouraged for novice users).
What's the point of making the "untrusted" group anyway? I don't see
how it changes anything.
Precisely. However, on, say, a fileserver, it can be very useful to have specific groups for specific access purposes. Development and testing environments may benefit from running processes with fewer priviledges, testing untrusted binaries (though jails are better for this). Generally, having an untrusted user can be useful in enterprise, but not for a stock desktop or workstation. There may be plenty more use-cases, so before this digresses, I'll stop at that and leave the rest to your reading.
Revoke the read, write, and execute (rwx) Group and Other rights on
all other home directories: ??? If I do chmod go-rwx /home/*/, then
other sudoers can't even read guest's directories--that's not what I
want!--I just want guest to not be able to read others' directories
No, of course you don't. Revoking g (group) access will mess things up badly in this instance and not achieve your goals (to prevent guest messing with other users' home). Read this short explanation:
The default nature of adding a new user via adduser is:
- New user created with matching primary group id.
- New user receives a home folder, usually /home/USERNAME/ which that user has rwx privileges for.
- By default, no other privileges are given and no supplementary groups are assigned to the user (I hear some configurations do this, but it's not "vanilla" behaviour).
- Therefore, simply creating the user achieves everything you've stated you want to achieve. In other words, start over by deleting the user and home directory of the user and don't change anything until you know what, if anything, needs altering. You can see the account's groups after creating it with
id USER. Thus you can remove any groups you guest shouldn't be in if your system has odd default behaviour.
I just want guest to not be able to read others' directories
By default, guest can read-only other files. If you want to make files private (visible only to the owner, group, and root), chmod -R o-rwx their directory. The 'o' means "other" or "world". This flag refers to anyone whose is not the file owner or a member of the group that owns the file (with the exclusion of root who is basically your User-Almighty). 'o-x' is needed to ensure directory listings cannot be made as directories are executable (out of scope)
Take ownership of any directories you want "guest" to have access to.
Note that since we used adduser above, guest already has access to his
"/home/guest" home folder. However, giving user "guest" of other
directories can be done as follows: sudo chown -hR guest
/any/directory/you/want/guest/to/own
No. If you want to share folders, create a new group called "shareful" (that's a joke because you must be "careful") and add all users who will share the directory to this group (usermod -aG shareful myuser). Then chown the group ownership of said folder to the shareful group (chown -R :shareful /this/path/) and chmod the permissions so group has rwx (chmod -R g+rwx /this/path). At this point you'll start wanting to look into umask, but that's out of the scope of this post.
Below is a link to umask info, but first, I think you need to re-read up on on basic *NIX file permissions (the first two links).
File Permissions:
(Wikipedia) https://en.wikipedia.org/wiki/File_system_permissions
(UNIX.com) http://www.unix.com/tips-and-tutorials/19060-unix-file-permissions.html
Linux and umask:
(Unfamiliar source) https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html
Hope this clarifies things at least enough to achieve what you want.
Best Answer
Classical solution for shared folders is sticky bit, that prevents deleting files of other users. The best example is /tmp dir.
Therefore, set the following ownership:
and permissions:
I'd recommend the following POSIX ACL：
Only users of group
workcan edit newly created files and dirs but can not delete the files of each other.