user restricted to particular directory

[jiun bookworm <thebookworm101@xxxxxxxxx>]

I have an application   running as  user "app" with a  home directory in  /ap/app

i'd like to restrict the application (started as a service so there's no ssh/console login) to

/ap/app, with access to  other binaries  in  /ap/python  and  /opt/support-app   and access to a high  port on localhost,  what would be the best way to do that?

it does not need read/write  access anywhere else only in subdirectories of /ap/app

--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux