How to manage user privileges in Ubuntu

Sure, simply set all the folders in the users home to read only (except the documents as these will need to be writable to save data). If you setup the system EXACTLY how you want it then run:

cd ~/;chmod o-w ./.*

will mean all the settings will stay as is, you will need to test to make sure the system runs ok by rebooting then loging on. Make sure the user can log on and use apps fully, test torrenting, web browsing etc. You will need to give write access to SOME folders (e.g. browser config folders so that temporary internet files can be written etc) but you will slowly have to give write access back to make the system usable. Once you have given enough access and everything that is needed runs well then I suggest you make a backup to make life easier should you need to reinstate it. The user should also not be in the admin group as it will be able to use sudo and gksudo to circumvent the permissions.

First thanks for your answer!

If I understand correctly I have to go to the HOME folder, then select the folder of the user I want to manage, and change the folders in that user to read only.

Then I go to the terminal and run cd ~/;chmod o-w ./.*
That will mean all settings will stay as is for all the users or one?

On the last step you say that I have to give the user write access to some folders like "browser config" but that folder is not in the HOME folder so why it would have changes?

Thank you!

It is done for only one user at each time.
Best is to write a bash script, to run after each user account creation, as root.
The "browser config" is under $HOME directory, but can be hidden (filename start with a dot).

The best is you to explain the context in which you work. So we could propose you the simplest solution.
Can you tell me also what is your level in system administration.

no, the chmod command will set ALL the folders in home to read only by the owner, you can then use chmod (or nautilus ran with gksudo) to add the various write accesses which are needed for apps to run (for example email clients will need write access to download mail to and browsers will need write access to their folders so that data can be downloaded and viewed in the browser). The folder IS in home, it is managed on a user by user basis

Most people use crappy firefox which uses the folder ~/.mozilla so the user will need write access if any websites are to be viewed. This is just one example of what you need to do. You can even do all this AS the user if it is in the admin group, as sudo / gksudo will allow it circumvent the access. This will allow quick testing too. Once all is well simply remove the user from the Admin group and it will be complete.