Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to monitor user actions on the file system and prevent him from performing particular actions? Can inotify only monitor actions on the file system? What about fanotify? There's very little about it in Web...

My program (daemon) sends particular files over network. I want to make sure, that user will not delete or move my file however he cloud be able to read it. When user tries to delete my file with any program calling eg. unlink() I want to make this unlink() call will fail with some error (EACCES?). I can do similar trick implementing file system on FUSE, but it's not a solution here...

share|improve this question
You could likely do it by registering a shell that will start other programs always with LD_PRELOAD and an .so that overrides unlink. This way you can limit it to that user and the respective implementation in the .so can limit it to whatever files or paths you want to secure. But the immutable attribute is the better choice as only root can remove it. – 0xC0000022L Mar 19 '14 at 12:17

What you're asking is easily achieved through traditional unix permissions. Make sure that the user can access the directory where the file is stored but not write to it (r-x permissions on the directory and its ancestors). Give the user read permission to the file, but not write permission (assuming the user shouldn't be able to modify the file), i.e. r--. With no write permission on the directory, the user won't be able to delete the file.

Monitoring won't help you there. It could tell you that the user deleted the file, but you can't prevent an action from happening merely by monitoring this action.

share|improve this answer
Ok, but I want to dynamically select "protected" files depending on user choices (user choices which file should be sent by my daemon). I should write it earlier... – Goofy Jan 8 '12 at 23:13

Although Gilles makes a good suggestion, another option (if, for example, you can't control the directory permissions) would be to set the immutable flag on the file, with chattr +i. This would prevent any user from writing to or deleting the file in question. Note that this requires root access.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.