Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm creating a hidden "Access Log" .txt file of employees accessing a program I've created and need to know how to make it so this file cannot be deleted.

Reason being, this program helps to automate a lot of tasks that we perform on workstations, and it can do a lot of damage as well. So I need to track who accesses it just in case it becomes an issue.

Reiterating the question, how do I keep anyone from deleting this file while still being able to write to it.

share|improve this question
Bear in mind that being able to write to a file but not delete it will still allow blanking of the file. – Chris Down Sep 15 '11 at 17:46
@Chris Thanks for pointing that out. I can add a line to temporarily change permissions on the file to write the data into the log, then change it back. – Mechaflash Sep 15 '11 at 17:55
up vote 5 down vote accepted

I guess that you have users that each time they start an application, this application keeps track of who started it by writing some information in a file located in the samba share accessible by all workstations. Since you're referring to "Access Log", I also guess that you only need to append to the file and not modify its contents.

If the file is on an ext2/3/4 file-system on the server side, then make sure that samba users don't have write permissions to its directory. This will avoid accidental or intensional deletion. Then enable the append-only attribute with chattr +a <filename>, so information can only be added and not removed/modified/truncated. The file can still have write permissions to everyone, so the application can append to it even with the users' privileges.

Note: chattr might work for other file-systems too, eg. xfs. I don't have an exact list.

share|improve this answer

Essentially, what you do here is logging, so you might prefer to use a remote logging daemon like rsyslogd to do your logging instead of hacking a file in a samba share.

This said, the deletion of a file is a change of the directory containing the file, not of the file. So, if you remove write permissions for your users on the directory, the file cannot be deleted. Of course, it can still be manipulated or accidentally truncated.

share|improve this answer

The goal of being able to write to a file and allow a group of users read-only access can be achieved by file ownership and permissions. Let's say all the users that need such access are in 'users' group and you alone have access to the root account on that system. Then do (as root):

touch /var/log/AccessLog
chown root:users /var/log/AccessLog
chmod 640 /var/log/AccessLog

From now on, only root will be able to modify the file but all users will be able to read it.

If instead you want to allow the users to write to the file, but need to keep track of who (and when) has modified it, you might use FAM (File Alteration Monitor). Above that, to keep a record of all previous versions of the file, you can put a Version Control System (like GIT for example)) - you can make it cooperate with FAM so that each file modification triggers a commit to the local repository. There probably can be easier ways to do it but nothing comes to my mind (at least nothing that would work on top of a filesystem).

share|improve this answer

If your files modified only first minutes after creation crontab next:

find /somedir -type f -user sambauser -mtime +3m -exec chown root:users {} \; -exec chmod 640 {} \;

Will find all files with time from last modification over 3 minutes and change owner/permissions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.