How to I use Linux Groups to restrict read, write, execute access by other users to a directory?

I don't know why you would need an "untrusted" group if you only have one "guest" (and you should only have one guest, usually). The group "guest" can be used as "untrusted" would. Anyway, I'll try to be brief with an explanation to point you in the right direction:

??? (did I do the above so far correctly???) --I still want other super users to be able to see guest's files.

Anyone who's logged into the account "root" can do this. Either use su -c "do something" or sudo do something. To login as root, use su root (or just su as it defaults to root with no args) or sudo -i (but know that logging in as root is discouraged for novice users).

What's the point of making the "untrusted" group anyway? I don't see how it changes anything.

Precisely. However, on, say, a fileserver, it can be very useful to have specific groups for specific access purposes. Development and testing environments may benefit from running processes with fewer priviledges, testing untrusted binaries (though jails are better for this). Generally, having an untrusted user can be useful in enterprise, but not for a stock desktop or workstation. There may be plenty more use-cases, so before this digresses, I'll stop at that and leave the rest to your reading.

Revoke the read, write, and execute (rwx) Group and Other rights on all other home directories: ??? If I do chmod go-rwx /home/*/, then other sudoers can't even read guest's directories--that's not what I want!--I just want guest to not be able to read others' directories

No, of course you don't. Revoking g (group) access will mess things up badly in this instance and not achieve your goals (to prevent guest messing with other users' home). Read this short explanation:

The default nature of adding a new user via adduser is:

1. New user created with matching primary group id.
2. New user receives a home folder, usually /home/USERNAME/ which that user has rwx privileges for.
3. By default, no other privileges are given and no supplementary groups are assigned to the user (I hear some configurations do this, but it's not "vanilla" behaviour).
4. Therefore, simply creating the user achieves everything you've stated you want to achieve. In other words, start over by deleting the user and home directory of the user and don't change anything until you know what, if anything, needs altering. You can see the account's groups after creating it with id USER. Thus you can remove any groups you guest shouldn't be in if your system has odd default behaviour.

I just want guest to not be able to read others' directories

By default, guest can read-only other files. If you want to make files private (visible only to the owner, group, and root), chmod -R o-rwx their directory. The 'o' means "other" or "world". This flag refers to anyone whose is not the file owner or a member of the group that owns the file (with the exclusion of root who is basically your User-Almighty). 'o-x' is needed to ensure directory listings cannot be made as directories are executable (out of scope)

Take ownership of any directories you want "guest" to have access to. Note that since we used adduser above, guest already has access to his "/home/guest" home folder. However, giving user "guest" of other directories can be done as follows: sudo chown -hR guest /any/directory/you/want/guest/to/own

No. If you want to share folders, create a new group called "shareful" (that's a joke because you must be "careful") and add all users who will share the directory to this group (usermod -aG shareful myuser). Then chown the group ownership of said folder to the shareful group (chown -R :shareful /this/path/) and chmod the permissions so group has rwx (chmod -R g+rwx /this/path). At this point you'll start wanting to look into umask, but that's out of the scope of this post.

Below is a link to umask info, but first, I think you need to re-read up on on basic *NIX file permissions (the first two links).

File Permissions: (Wikipedia) https://en.wikipedia.org/wiki/File_system_permissions (UNIX.com) http://www.unix.com/tips-and-tutorials/19060-unix-file-permissions.html

Linux and umask: (Unfamiliar source) https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html

Hope this clarifies things at least enough to achieve what you want.

Reading your question, it seems you're only interested in permissions on /home directories, not other ways of restricting user permissions. In that case, you're close.

Sudoers

First, no need to worry about sudoers. They don't obey the file permissions you see. Here's how to try it:

mkdir test
touch test/test_file
ls test  # works!

chmod 000 test
ls test       # can't open directory, permission denied
sudo ls test  # works!

Permissions

Now let's briefly recap file permissions. If you do ls -l you'll see that most directories have drwxr-xr-x permissions. That translates to:

• User - rwx permission
• Group - rx permission
• Other - rx permission
• The d just means that this "file" is a directory. Remember that you need execute permissions to list the contents of a directory.

If those permissions were on /home/guest then the "Other" permissions allow anyone to list the contents of that directory. So you want this:

chown guest:guest /home/guest  # Change owner and group of directory to guest
chmod 750 /home/guest

Login to the guest1 and guest2 accounts and try it!

Fancy chmod numbers

rwx each correspond to a bit. Converting binary numbers (base 2) to numbers humans use (base 10) you get:

• r - 4
• w - 2
• x - 1

Thus

• rwx = 7
• rx = 5