I would like to give a user permissions to create and read files in a particular directory, but not to modify or delete files. If the user can append to files that is ok, but I'd rather not. This is on Ubuntu Linux.
I think this is impossible with standard Unix file permissions, but perhaps this is possible using ACLs? The user will always be connecting using SFTP, so if there was some way to control this within SFTP (as opposed to OS permissions) that would be fine.
To be absolutely clear, I want the following:
- echo hello > test # succeeds, because test doesn't exist, and creation is allowed
- echo hello >> test # can succeed or fail, depending on whether appending is allowed
- echo hello2 > test # fails, because test already exists, and modification is not allowed
- cat test # succeeds, because reads are allowed
- rm test # fails, because delete is not allowed
If you're wondering why I want to do this, it's to make a Duplicati backup system resistant to Ransomware.