Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a process that create directories and files inside a working directory, ex:

/workingdir/file1
/workingdir/file2
/workingdir/dir1/file1
/workingdir/dir1/dir2/file1
/workingdir/dir1/file2

I need to avoid deletion/overwrites of created folders/files for that user, but allow subsequent folders/subfolders/files creation. I try permissions, gid, acl with no luck.

What is the correct way to do that ? (i can use a cron job if needed)

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

You should be able to achieve something by setting extended attributes with chattr.

Use chattr +a on your directories. This will allow them to be added to but will stop them from having files removed.

Use chattr +i to make your files immutable - they cannot be changed once this is set.

A file with the ‘a’ attribute set can only be open in append mode for writing. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

A file with the ‘i’ attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

share|improve this answer
    
The perfect combination. Thankyou –  Peraz Oct 2 '12 at 10:30
add comment

This is not possible with standard POSIX unix file permissions.

The best you can accomplish is a directory where users will be able to delete any files they own, but not those of other users.

chmod 1775 /directory

UPDATE: You can have more fine gained control with SELinux or Apparmor but from that approach you have to give permissions to processes on files.

UPDATE: You have the option of using the system append-only flag for separate files. Not on all filesystems: chattr +a filename

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.