immutable-like flag for perms

Question

Is there any chattr flag that would allow me to lock a file's unix permissons, and not change them without resetting the flag? The file itself should still be modifiable, I just want to prevent ... ignorant people ... from changing the permissions to something wrong accidentally.

Answer 1

There is no such flag with Linux chattr. You can either make the file immutable or append-only (in either case, the file's permissions and ownership will be locked), or allow the owner of the file and root to change the permissions. (The immutable attribute on a directory prevents creating or removing files from it but not changing entries' metadata.)

If changing the ownership of the file is acceptable, do it, and use access control lists (or group ownership) to give whoever needs it read and write access to the file. If this is a social issue where your fellow roots can't be relied on, I don't think you'll find a satisfactory technical issue.

Disallowing the owner of a file to change permissions falls into the category of mandatory access control, which is not something unix traditionally supports. There are several MAC frameworks on Linux, and the two major ones are SELinux and AppArmor; I don't know whether they do allow what you're trying to do.

If this is a general problem, you could look into using a database for storage. You can typically give someone the permission to read and write to a table without letting them control the permissions.

A less drastic step than moving to a database would be moving the files to a different filesystem (this may or may not be feasible in your setting). You could then use symbolic links in the place where the files must exist, and hope the permission changers aren't sophisticated enough to look in the place where the real files are (perhaps that could be made read-only?).

A FUSE filesystem that mirrors file contents but changes metadata is another possibility. An existing one is bindfs, which can rewrite permissions (-o perms=…) and can ignore chmods (-o chmod-ignore).