2

I have a process that create directories and files inside a working directory, ex:

/workingdir/file1
/workingdir/file2
/workingdir/dir1/file1
/workingdir/dir1/dir2/file1
/workingdir/dir1/file2

I need to avoid deletion/overwrites of created folders/files for that user, but allow subsequent folders/subfolders/files creation. I try permissions, gid, acl with no luck.

What is the correct way to do that ? (i can use a cron job if needed)

4

You should be able to achieve something by setting extended attributes with chattr.

Use chattr +a on your directories. This will allow them to be added to but will stop them from having files removed.

Use chattr +i to make your files immutable - they cannot be changed once this is set.

A file with the ‘a’ attribute set can only be open in append mode for writing. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

A file with the ‘i’ attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

  • The perfect combination. Thankyou – Peraz Oct 2 '12 at 10:30
2

This is not possible with standard POSIX unix file permissions.

The best you can accomplish is a directory where users will be able to delete any files they own, but not those of other users.

chmod 1775 /directory

UPDATE: You can have more fine gained control with SELinux or Apparmor but from that approach you have to give permissions to processes on files.

UPDATE: You have the option of using the system append-only flag for separate files. Not on all filesystems: chattr +a filename

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.