I'd like to create on my N900 a new user that's very restricted:
having read-only rights to the /media/mmc1/DCIM/mp3 directory, & being unable to see, go to, or do anything with the rest of the file system.

The purpose is to create a guest login to allow sftp: connection via Rhythmbox on another computer to play music from the N900.

I've seen pages on the Linux "adduser" command, but haven't been able to figure out how to give the user such a narrow scope of rights: read-only in only one directory (and its subdirectories), & nothing else.

Perhaps add them to a group that only has read-only access to that folder?

Unfortanly, we do not have a security framework like apparmor on the N900(probably selinux, but nobody cared about it yet afaik). Anyway, you need Access Control Lists (setfacl). There is just one problem: the rootfs is ubifs, and ubifs does not have acl support, which basically prevents/limits you to achieve what you want.

But there should be other/better solutions to stream music from the N900 than using sftp/sshfs or something like that.