Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is NOT your standard "how do permissions work" question!

I'm thinking the answer will probably involve ACL, but I don't know how exactly.

I've messed around with standard permissions, guid, sticky bit, etc. Doesn't work.

What I want: User will upload files. User will have ability to change permissions on files to allow execution. But user will not be able to change the contents of file once it's created. And user will not be able to delete the file.

Please help! I've been tearing my hair out for hours!

EDIT:

Thanks for the answers but so far they don't seem to address how to have this work automatically for newly-created files.

Possible solution:

find -mtime -1 -exec chattr +i '{}' \+

2nd possible solution:

inotifywait -m -e create --format %f .

Now I just need to figure out to pipe that to chattr.

share|improve this question
    
but so far they don't seem to address how to have this work automatically for newly-created files -- Can't happen. Sorry to disappoint. –  tylerl Nov 15 '12 at 6:38
    
@tylerl "but so far they don't seem to address how to have this work automatically for newly-created files -- Can't happen. Sorry to disappoint" -Anything is possible. See my suggestion, which I'm about to add to my edit. –  Buttle Butkus Nov 15 '12 at 6:39
    
The way that it's possible is to have whatever mechanism you used to upload the files ALSO run chattr. That's different from automatic –  tylerl Nov 15 '12 at 6:40
    
"The way that it's possible is to have whatever mechanism you used to upload the files ALSO run chattr. That's different from automatic" Hmmm, no I don't think FTP program could run chattr. cron is close to automatic, but not ideal. Ideally, some program would be notified at file creation and immediately run chattr. Something like that... –  Buttle Butkus Nov 15 '12 at 6:42
    
I'm going to have to ask you again: What are you trying to do? –  Michael Hampton Nov 15 '12 at 6:52

2 Answers 2

You can try to use 'chattr'

Example:

urug@nada.cclan:~$ sudo chattr +i plik.txt 
urug@nada.cclan:~$ rm plik.txt 
rm: remove write-protected regular empty file `plik.txt'? y
rm: cannot remove `plik.txt': Operation not permitted
urug@nada.cclan:~$ chattr -i plik.txt 
chattr: Operation not permitted while setting flags on plik.txt
share|improve this answer
    
Very nice but how to have it automatically set at the time of file creation? See edit to my post. –  Buttle Butkus Nov 15 '12 at 6:36
    
You can use 'inotify' or similar mechanism to do it automatically kernel.org/doc/man-pages/online/pages/man7/inotify.7.html –  Tomasz Olszewski Nov 15 '12 at 6:41
1  
    
those look good but will it work on CentOS. Your link is for Ubuntu. –  Buttle Butkus Nov 15 '12 at 6:46
1  
inotify is universal, not related to any distro. You need only to implement mechanism that will use it. I googled a little for you, nixcraft.com/centos-rhel-fedora/… –  Tomasz Olszewski Nov 15 '12 at 6:49

Use attributes

sudo chattr +i /path/to/file

Remove "immutable" flag with

sudo chattr -i /path/to/file

That'll prevent you from changing permission on the file, though. So you'll need some way to (as root) add execute permission or whatever upon user request. Also, attributes are not added by default; you have to put in somethin that will do that to.

I'll leave that bit as an exercise to the reader.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.