Protect subfolders in a public share

Question

CentOS box with smb and afp.

There is a a share that everyone has read/write access to, I want to prevent a couple folders within that share from being able deleted, but still allowing full read/write within them.

From my reading of the chmod manpages I don't see how to do that.

Any suggestions?

Answer 1

Use the sticky bit (o+t) on the parent directory and change the owners of the directories or files you want to make un-removable to a different user.

If you don't want them deleting ANY files from the directory, including ones they make, then continue from above and add the SUID bit to the directory (u+s). This will cause all files to be created with the owner being the owner of the directory (which may result in files that the user cannot open again, based on their umask). The suid bit cascades to new directories automatically, however the sticky bit will not, so its protection is only for files directly in the one directory, so this will not be able to prevent users from creating files in subdirectories and then deleting them.

Using a networked filesystem complicates this just a little, since all you need to do is change it to a user different from the one that samba is using for the connection (are you mapping every remote user to one "samba" user or using local usernames for everyone?), but you'll still need to have permissions that allow samba to access the contents of directories.

Also, note that this may make editing files impossible with some editors even if the file itself has +w set, since many editors actually save by writing a temporary file, then attempt to rename the original to a backup file before renaming the temporary file into its final place, but they will be unable to rename files they don't own in a sticky directory.

Answer 2

I'm afraid you're out of luck. To do that sort of thing, the network-filesystem server (smb, afp) needs to support xacls and have one of those xacls mean "prevent delete of this directory". Samba and NetATalk don't have those to the best of my knowledge.

I know of only one such system that does, and that would be the NCP server in Novell's Open Enterprise Server, which does support such 'flags' on a directory. I don't know of anything else that does it though.