Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am attempting to mount a cifs drive in standard Ubuntu 12.04.2 LTS using the following line in /etc/fstab:

//server-name/share-name  /mnt/archive  cifs  uid=1002,file_mode=0440,credentials=/etc/.smbcredentials,iocharset=utf8,sec=ntlmi  0  0

This mount will be used to store backups, so I would like to mount it with permissions to create files, but not delete them. Everything seems to be working as it should, except I can go in and delete away with nothing but a warning.

myuser@localhost:/mnt/archive$ ls -l
-r--r----- 0 myuser root     51 Sep 19 17:56 deleteThis.txt
-r--r----- 0 myuser root     51 Sep 19 17:31 deleteThis.txt.bak

myuser@localhost:/mnt/archive$ rm deleteThis.txt.bak
rm: remove write-protected regular file `deleteThis.txt.bak'? y

myuser@localhost:/mnt/archive$ ls -l
-r--r----- 0 myuser root     51 Sep 19 17:56 deleteThis.txt

Why are my file privileges not being respected? Is this an Ubuntu thing?

Is there a way to mount the network share through cifs without exposing the files to deletion?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Linux does not manage the permission to delete files separately from the permission to create files. In both cases, what matters is whether you have write permission to the directory. Since you left the default mode for directories, myuser can write to /mnt/archive and therefore can delete files there as well as create them.

rm prompts for confirmation when you try to delete a read-only file, but that doesn't mean that you don't have the permission to delete it: it means that you do have the permission to delete it but rm thinks it might be a bad idea to do so.

You can prevent users from deleting files that they do not own by setting the “sticky bit” on the directory (chmod +t), as is done for /tmp. Use the mount option dir_mode=1755.

You cannot prevent users from deleting their own files except by not giving them the permission to create files in that directory either.

It is odd to allow users to create files that they cannot delete. If you really want that, you'll need something more flexible than classical unix file permissions or Solaris/Linux ACLs (I think you can do it with OSX ACLs).

share|improve this answer
    
So basically the owner permission is completely meaningless and redundant? I can't imagine a single circumstance where you would want to allow someone to delete a file but not edit it. I can imagine quite a few instances where you would want to create an archive and not allow it to be deleted or removed without escalation of privilege. I'm still hoping there is a solution to this, as I remember doing this just fine in Slackware w/ smbfs (although it was quite some time ago, so I could be misremembering). –  drkstr1 Sep 19 '13 at 22:59
    
@drkstr1 The permissions on a file control whether the file can be read, written to or executed. There is no delete permission. Owner permissions are enforced, they are only redundant in the sense that the owner can change them. If you remember doing this on another distribution, you misremember. Perhaps you made the same confusion shown in your question between having the permission to write to a file and having the permission to delete it, or perhaps you had files that only the owner could delete but not others who could write to the same directory. –  Gilles Sep 19 '13 at 23:05
    
I understand rwx permissions just fine. My confusion (or curiosity) is to the desired intent of setting a file to read-only. It just seems silly to me that this would prevent someone from editing a file, but not deleting it. I don't disagree with you, I just find it odd. I suppose I will need to enforce this from the other side of the connection (which is probably what I ended up doing long ago). Thank you for your time. –  drkstr1 Sep 19 '13 at 23:15
    
and it just hit me... there would be no way to enforce such a thing at the file level. When adding and deleting it's the directory being edited, not the file itself. I may rest easy now. :) –  drkstr1 Sep 19 '13 at 23:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.