I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?
The elegant way would be using richacls. But that is not an official part of the kernel yet and thus may be difficult to use for you.
An easy workaround would be to use the samba parameters
The funny (and portable!) way would be to create so many (invisible) subdirectories that the file system's subdirectory limit is reached. If a new subdirectory is needed the admin would simply rename one of them.
What you can do is use a FUSE filesystem like
Compile it with:
Which will mount
You'll still be able to rename directories though.
On Linux and ext4 file system, a hacky way to prevent directories (and not other types of files) from being created is to rely on the fact that newly created directories inherit the default ACL entries from their parent directory (in addition to the corresponding non-default ACL entries) while files only get assigned the corresponding non-default ACL entries and on ext4 at least, there's only a limited space per inode for storing those ACL entries.
So, if you fill up that space for a directory with default ACL entries up to the brim, you'll still be able to create files in there, but not directories as the system will not be able to create both the default and non-default ACL entries:
(the exit condition on that loop is when setfacl fails (here on ENOSPC because no more ACL entries can be added)).
507 default ACL entries were added (effectively denying access to any file and directory created in there to users 50000 to 50506).
That doesn't prevent users from removing or renaming directories in there though (if some have been created prior to you adding those default ACLs).