Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible, using linux permission scheme, to allow users create files but not edit or delete them at a later time? I mean, we have a delivery folder where users put artifacts there and we do not want these artifacts to be modified after delivered i.e. edited or deleted.

share|improve this question

migrated from stackoverflow.com Jun 29 '11 at 20:28

This question came from our site for professional and enthusiast programmers.

4  

Is it possible, using linux permission scheme, to allow users create files but not edit or delete them at a later time?

NO

But you have other options as suggested by @Fredrik in the comment to your question. See here.

share|improve this answer

You can't do that: if the user can create files, they'll be owned by him, and he'll be able to modify them and erase them.

I was going to propose a simple scheme to have a staging directory (where the user can do what he wants) and an incoming directory (not accessible to the user), with a small privileged program to move files from the staging directory to the incoming directory. But it's actually tricky to do right: amongst other things you need to take care that the privileged program won't move files in other directories (beware of race conditions, symbolic links, ../), won't overwrite existing files (rename(3) is atomic but can erase the destination), won't let the user keep a file descriptor open and modify the file after it's moved (so you'd better copy than move). Instead, I'll recommend to take an existing, robust solution:

  • Have the user upload the file over HTTP.
  • Have the user commit to a version control system. He'll be able to commit new versions, too.
share|improve this answer

Here’s an approach that should, theoretically, work.  It’s too much effort for me to develop even a proof-of-concept; you may reject it for the same reason.  And, strictly speaking, this is not “using the Linux permission scheme.”

  • Get an open source file server.
  • Modify it to enforce the rules you want (i.e., users can create files in directories that they have write access to, and can write to a file immediately after creating it, but, thereafter, nobody but root can open a file for writing or unlink it).
  • Set up a server host running your modified server software.  Theoretically it could be your local host; just make sure that the directory it’s working from is not publically accessible.
  • NFS mount your /mnt/delivery and tell your users to put their files there.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.