3

I have a process that create directories and files inside a working directory, ex:

/workingdir/file1
/workingdir/file2
/workingdir/dir1/file1
/workingdir/dir1/dir2/file1
/workingdir/dir1/file2

I need to avoid deletion/overwrites of created folders/files for that user, but allow subsequent folders/subfolders/files creation. I try permissions, gid, acl with no luck.

What is the correct way to do that ? (i can use a cron job if needed)

2 Answers 2

6

You should be able to achieve something by setting extended attributes with chattr.

Use chattr +a on your directories. This will allow them to be added to but will stop them from having files removed.

Use chattr +i to make your files immutable - they cannot be changed once this is set.

A file with the ‘a’ attribute set can only be open in append mode for writing. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

A file with the ‘i’ attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

1
  • The perfect combination. Thankyou
    – Peraz
    Oct 2, 2012 at 10:30
2

This is not possible with standard POSIX unix file permissions.

The best you can accomplish is a directory where users will be able to delete any files they own, but not those of other users.

chmod 1775 /directory

UPDATE: You can have more fine gained control with SELinux or Apparmor but from that approach you have to give permissions to processes on files.

UPDATE: You have the option of using the system append-only flag for separate files. Not on all filesystems: chattr +a filename

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .