2

I want to use a directory as a sort of drop-off point, similar to the Public folder in each Mac OS X home directory, that is: certain users (or everyone) should be able to create new files inside this directory, but nothing else - no new subdirectories, no modification or overwriting of existing files, no reading of any kind etc.

The system where this takes place is OmniOS/Solaris with ZFS, shared with the Solaris CIFS module as a SMB share. Therefore, I read the documentation on the ACL model and after some trial and error got it working with just

/usr/bin/chmod A+user:alice:-w------------:-------:allow /pool/share/dropbox

Without any inheritance, the dropped files will only have the name of alice as owner, but as she has no permissions at all on the individual files, she is not listed anywhere else (for example, via /usr/bin/ls -V .).

Although this does what I want, I wonder if this is the correct way to do it or if I should add any other permissions explicitly, for example permissions W (write extended attributes) or A (change timestamp/attributes).

While testing I noticed that if one wants to also grant read properties to the directory and files, an additional ACE is needed (one for files only with one level of propagation and one for the directory itself):

A+user:alice:r-x---aAR-c--s:f--n---:allow
A+user:alice:rwx-----------:-------:allow

Now I wonder - if those additional attribute values are needed for reading, wouldn't they also be needed for writing? Do I lose anything valuable later on, or is this more of a "If you don't know it, you don't need it!" thing?

Improve this question

1 Answer 1

Reset to default
0

ACLs would probably be the way to go as your research found.

The easiest way to handle everything you want other than locking down directory creation would be using the sticky bit. ie: look at the perms on /tmp and /var/tmp.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .