Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

The elegant way would be using richacls. But that is not an official part of the kernel yet and thus may be difficult to use for you.

An easy workaround would be to use the samba parameters directory mask and force directory security mode to render newly created directories useless (inaccessible) to the users so that they learn not to create directories.

The funny (and portable!) way would be to create so many (invisible) subdirectories that the file system's subdirectory limit is reached. If a new subdirectory is needed the admin would simply rename one of them.

share|improve this answer
2  
+1 for the portable method –  zje Jun 4 '13 at 15:39
    
thanks! i will try it! –  acvF Jun 4 '13 at 16:04
    
... specs changed, some users have to be able to create directories, so i will try to recompile the kernel with richacl –  acvF Jun 5 '13 at 16:13
add comment

What you can do is use a FUSE filesystem like bindfs in combination with a LD_PRELOAD hijacker that disables the mkdir and rmdir system calls. Like create a wrapper.c file with:

#include <errno.h>
int mkdir() { errno = EPERM; return -1; }
int rmdir() { errno = EPERM; return -1; }

Compile it with:

gcc -fPIC -shared -o wrapper.so wrapper.c

And run:

LD_PRELOAD=$PWD/wrapper.so bindfs the-dir the-dir

Which will mount the-dir over itself but without the ability of creating a deleting directories.

You'll still be able to rename directories though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.