6

Is there some permissions setup that would allow a user, say, john, to add a file to a directory d, but not be able to remove an existing file owned by another user, say, root?

My understanding is that this is not possible, since one needs execute permissions to add a file to the directory, but this also gives on the power to unlink any file in the directory.

(I'm using Mac OS 10.9, but this question presumably applies to all POSIX-ish systems.)

6

Yes, to do so, you would want to set the sticky bit for that directory.

excerpt

Another important enhancement involves the use of the sticky bit on directories. A directory with the sticky bit set means that only the file owner and the superuser may remove files from that directory. Other users are denied the right to remove files regardless of the directory permissions. Unlike with file sticky bits, the sticky bit on directories remains there until the directory owner or superuser explicitly removes the directory or changes the permissions.

That is, you would give user john execute permissions on the directory d so that they could add files to it, and then mark the directory as "sticky" with chmod +t /path/to/d to ensure that john (and any other users with +x permissions) are only able delete files (or subdirectories) that they own.

  • Wow, so cool. Thanks for pointing this out. According to the man page, the directory owner can also remove files: "A file in a sticky directory may only be removed or renamed by a user if the user has write permission for the directory and the user is the owner of the file, the owner of the directory, or the super-user. This feature is usefully applied to directories such as /tmp which must be publicly writable but should deny users the license to arbitrarily delete or rename each others' files." – AmadeusDrZaius Sep 21 '14 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.