Skip to content
Search

Disk quota

lastmod 2025-02-17created 2023-07-064 edits

Per-user and per-group storage management

Guide to reserving directory space and restricting R/W on Linux

On Linux, there are several ways to reserve a large amount of space in a specific directory in advance and then prevent users from reading and writing that space.

The main methods are below:

Disabling the directory for specific users/groups (permission settings)

Create the directory and reserve space: 

mkdir /path/to/directory
fallocate -l 10G /path/to/directory/dummy_file
  • The command above reserves 10GB of space in advance under the name dummy_file.

Set directory permissions: 

chmod 000 /path/to/directory
  • chmod 000 removes read, write, and execute permissions on the directory for all users.

Allow access for a specific user only (optional): 

chown root:root /path/to/directory
chmod 700 /path/to/directory
  • To restrict access to the root user only, set it as above.

Allocating a file system and mounting it

Create a virtual disk image: 

dd if=/dev/zero of=/path/to/disk.img bs=1G count=10
  • Creates a 10GB virtual disk as the disk.img file.

Create the file system: 

mkfs.ext4 /path/to/disk.img

Mount the file and restrict permissions: 

mkdir /mnt/secured_dir
mount /path/to/disk.img /mnt/secured_dir
chmod 000 /mnt/secured_dir
  • /mnt/secured_dir is now a 10GB space that cannot be read or written.

Limiting directory capacity with the Quota system

To let users access a specific directory but apply write limits, you can set up the Quota system.

Enable file system Quota:

Add the setting below to /etc/fstab: 

/dev/sdX /mount/point ext4 defaults,usrquota,grpquota 0 1

Configure Quota: 

mount -o remount /mount/point
quotacheck -cug /mount/point
quotaon /mount/point

Apply limits to a specific user 

edquota -u username
  • Set the per-user storage limits here.

Blocking R/W with a loopback device

Create a file and set up the loopback device: 

dd if=/dev/zero of=/path/to/loopback.img bs=1G count=10
losetup /dev/loop0 /path/to/loopback.img
mkfs.ext4 /dev/loop0

Mount the loopback device, then block it: 

mkdir /mnt/loop_dir
mount /dev/loop0 /mnt/loop_dir
chmod 000 /mnt/loop_dir

Applying a custom SELinux policy (when SELinux is enabled)

Set the directory's SELinux context: 

chcon -R -t unconfined_u:object_r:default_t:s0 /path/to/directory

Block user access: 

semanage fcontext -a -t unconfined_u:object_r:default_t:s0 /path/to/directory
restorecon -R /path/to/directory

See also

Favorite site

author Zer0 sitemap