1

This is NOT your standard "how do permissions work" question!

I'm thinking the answer will probably involve ACL, but I don't know how exactly.

I've messed around with standard permissions, guid, sticky bit, etc. Doesn't work.

What I want: User will upload files. User will have ability to change permissions on files to allow execution. But user will not be able to change the contents of file once it's created. And user will not be able to delete the file.

Please help! I've been tearing my hair out for hours!

EDIT:

Thanks for the answers but so far they don't seem to address how to have this work automatically for newly-created files.

Possible solution:

find -mtime -1 -exec chattr +i '{}' \+

2nd possible solution:

inotifywait -m -e create --format %f .

Now I just need to figure out to pipe that to chattr.

  • but so far they don't seem to address how to have this work automatically for newly-created files -- Can't happen. Sorry to disappoint. – tylerl Nov 15 '12 at 6:38
  • @tylerl "but so far they don't seem to address how to have this work automatically for newly-created files -- Can't happen. Sorry to disappoint" -Anything is possible. See my suggestion, which I'm about to add to my edit. – Buttle Butkus Nov 15 '12 at 6:39
  • The way that it's possible is to have whatever mechanism you used to upload the files ALSO run chattr. That's different from automatic – tylerl Nov 15 '12 at 6:40
  • "The way that it's possible is to have whatever mechanism you used to upload the files ALSO run chattr. That's different from automatic" Hmmm, no I don't think FTP program could run chattr. cron is close to automatic, but not ideal. Ideally, some program would be notified at file creation and immediately run chattr. Something like that... – Buttle Butkus Nov 15 '12 at 6:42
  • 1
    I'm going to have to ask you again: What are you trying to do? – Michael Hampton Nov 15 '12 at 6:52
4

You can try to use 'chattr'

Example:

urug@nada.cclan:~$ sudo chattr +i plik.txt 
urug@nada.cclan:~$ rm plik.txt 
rm: remove write-protected regular empty file `plik.txt'? y
rm: cannot remove `plik.txt': Operation not permitted
urug@nada.cclan:~$ chattr -i plik.txt 
chattr: Operation not permitted while setting flags on plik.txt
2

Use attributes

sudo chattr +i /path/to/file

Remove "immutable" flag with

sudo chattr -i /path/to/file

That'll prevent you from changing permission on the file, though. So you'll need some way to (as root) add execute permission or whatever upon user request. Also, attributes are not added by default; you have to put in somethin that will do that to.

I'll leave that bit as an exercise to the reader.

1

SELinux might be one way to solve it - associate unique type with all users that will have this "reduced ability". Set SELinux policy to allow file creation in this directory for those user types but not modification etc. In theory - should work. See Gentoo SELinux Tutorial, in particular pice about:

allow auditd_t <type>:file { <permission> };

then check out more on permissions available

1

Use inotify or other watching mechanism of your choice to find and locate new files in the upload directory and move them into a new directory, for which the initial user has no permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.