How to detect and stop user from deleting particular file on Linux?

Question

Is it possible to monitor user actions on the file system and prevent him from performing particular actions? Can inotify only monitor actions on the file system? What about fanotify? There's very little about it in Web...

My program (daemon) sends particular files over network. I want to make sure, that user will not delete or move my file however he cloud be able to read it. When user tries to delete my file with any program calling eg. unlink() I want to make this unlink() call will fail with some error (EACCES?). I can do similar trick implementing file system on FUSE, but it's not a solution here...

Answer 1

What you're asking is easily achieved through traditional unix permissions. Make sure that the user can access the directory where the file is stored but not write to it (r-x permissions on the directory and its ancestors). Give the user read permission to the file, but not write permission (assuming the user shouldn't be able to modify the file), i.e. r--. With no write permission on the directory, the user won't be able to delete the file.

Monitoring won't help you there. It could tell you that the user deleted the file, but you can't prevent an action from happening merely by monitoring this action.

Answer 2

Although Gilles makes a good suggestion, another option (if, for example, you can't control the directory permissions) would be to set the immutable flag on the file, with chattr +i. This would prevent any user from writing to or deleting the file in question. Note that this requires root access.