Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible, using linux permission scheme, to allow users create files but not edit or delete them at a later time? I mean, we have a delivery folder where users put artifacts there and we do not want these artifacts to be modified after delivered i.e. edited or deleted.

share|improve this question

migrated from stackoverflow.com Jun 29 '11 at 20:28

This question came from our site for professional and enthusiast programmers.

4  

3 Answers 3

You can't do that: if the user can create files, they'll be owned by him, and he'll be able to modify them and erase them.

I was going to propose a simple scheme to have a staging directory (where the user can do what he wants) and an incoming directory (not accessible to the user), with a small privileged program to move files from the staging directory to the incoming directory. But it's actually tricky to do right: amongst other things you need to take care that the privileged program won't move files in other directories (beware of race conditions, symbolic links, ../), won't overwrite existing files (rename(3) is atomic but can erase the destination), won't let the user keep a file descriptor open and modify the file after it's moved (so you'd better copy than move). Instead, I'll recommend to take an existing, robust solution:

  • Have the user upload the file over HTTP.
  • Have the user commit to a version control system. He'll be able to commit new versions, too.
share|improve this answer

Is it possible, using linux permission scheme, to allow users create files but not edit or delete them at a later time?

NO

But you have other options as suggested by @Fredrik in the comment to your question. See here.

share|improve this answer

Here’s an approach that should, theoretically, work.  It’s too much effort for me to develop even a proof-of-concept; you may reject it for the same reason.  And, strictly speaking, this is not “using the Linux permission scheme.”

  • Get an open source file server.
  • Modify it to enforce the rules you want (i.e., users can create files in directories that they have write access to, and can write to a file immediately after creating it, but, thereafter, nobody but root can open a file for writing or unlink it).
  • Set up a server host running your modified server software.  Theoretically it could be your local host; just make sure that the directory it’s working from is not publically accessible.
  • NFS mount your /mnt/delivery and tell your users to put their files there.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.