I am trying to restrict access to my home directory so as to prevent another user from accessing it, even another that user also has sudo permissions.
I've tried the following commands to achieve this
sudo chmod 0750 /home/user
sudo chmod 0755 /home/user
but if other user have sudo permissions they can change the permissions easily using
sudo chmod 0755 /home/user
Is there another way around this?
You can't do that. If you give sudo permission for user, he can execute any command or access any files on that system.
If you don't trust your user, give him restrictive sudo access to execute only a few commands by editing /etc/sudoers file.
Create a new group admins
Add lines to /etc/sudoers
%admins ALL = <Full path to command 1>, <Full path to command 2>
Before doing any of this, you should ensure you have a backup of your home directory and important files.
install the encryption utilities:
Open a terminal,
Press Ctrl+Alt+T
Run it:
sudo apt-get update
sudo apt-get install ecryptfs-utils cryptsetup
You’ll have to encrypt your home directory while you’re not logged in. You’ll need another user account with administrator privileges
You create one from Ubuntu’s User Accounts window:
Press your name on the panel and select User Accounts.
Create a new user account and make it an administrator.
Set a password by pressing the password box.
After creating the user account, log out of your desktop.
Select your new user account on the login screen and log in with it.
Open a terminal,
Press Ctrl+Alt+T
Run it, replacing user with the name of your user account:
sudo ecryptfs-migrate-home -u user
You’ll have to provide your user account’s password. After you do, your home directory will be encrypted.
Log out and log back in as your original user account.
Do not reboot your system before logging back in!
After you log in, press the Run this action now button to create a recovery passphrase.
Keep this passphrase somewhere safe – you’ll need it if you have to manually recover your files in the future.
You can run the ecryptfs-unwrap-passphrase command to view this passphrase at any time.
After restarting your system once or twice and verifying everything works properly, you can delete the user account and remove the backup home folder.
You can easily change the permissions for your home directory to protect your private files. To check the permissions on your home directory, press Ctrl + Alt + T to open a Terminal window. Type the following line at the prompt and press Enter. Replace <username> (aka lori) with your own username.
ls –ld /home/lori
At the beginning of the line, the permissions for the file are listed.
“The r stands for “read,” the w stands for “write,” and the x stands for “execute.” Directories will start with a “d” instead of a “-“. You’ll also notice that there are 10 spaces which hold value. You can ignore the first, and then there are 3 sets of 3. The first set is for the owner, the second set is for the group, and the last set is for the world.”
So, the home directory listed below has read, write, and execute permissions for the owner and read and execute permission for the group and world.
To change these permissions, type the following line at the prompt and press Enter.
sudo chmod 0750 /home/lori
Type your password when prompted and press Enter.
Press the up arrow twice to use the ls –ld /home/<username> command again to check the permissions. Notice that the permissions for world are all dashes (-). That means that the world cannot read, write, or execute anything in your home directory.
However, users in the same group as you can read and execute files and folders in your home directory. If you don’t want anyone else but yourself to have access to your home directory, enter 0700 as the numbers in the chmod command.
To close the terminal window, type exit at the prompt and press Enter.
Now, when other users on the system try to access your home directory, the following dialog box displays.
You can also set up Ubuntu to use specific permissions when setting up the home directory for a new user you are creating. To do this, you need to edit the adduser configuration file. To do this, type the following command at the prompt and press Enter.
gksudo gedit /etc/adduser.conf
Enter your password in the Password edit box on the dialog box that displays and press Enter or click OK.
Scroll down to the DIR_MODE command in the adduser.conf file. The number set is 0755 by default. Change it to reflect the different types of permissions (r, w, x) you want to grant to the different types of users (owner, group, world), such as 0750 or 0700 as discussed earlier. Click Save.
Close gedit by selecting Quit from the File menu. You can also click the X button in the upper-left corner of the window to close gedit.
Close the Terminal window by clicking the X in the upper-left corner of the window.
Now, the files in your home directory will remain private. Just remember that, if there are other users in the same group as you, you might want to take away the permissions for both group and world for your home directory.
Taken from (where other articles are referenced as well): http://www.howtogeek.com/190084/how-to-prevent-other-users-from-accessing-your-home-directory-in-ubuntu-14.04/
sudo. – Serpens Jun 29 '15 at 12:18