Automatically set append attribute for newly created files/folders?

Question

I'm trying to setup a folder so that users can only create or modify files/folders in it, but not delete them. I tried the 'chattr +a' command and got different results in RHEL5.8 and RHEL6.5 respectively. I tried the following command:

# chattr +a /home/share

In RHEL5.8, the 'append' attribute is automatically set for newly created files/folders under /home/share folder, which is what I want. But it is not the case in RHEL6.5, that cause users can still remove files/folders under sub-folfers of /home/share. For example:

$ mkdir /home/share/test-folder
$ touch /home/share/test-folder/test-file
$ rm /home/share/test-folder/test-file

The file 'test-file' still can be removed.

So my question is, in RHEL6.5, how can I get the same result as what I got in RHEL5.8? or is there other solutions?

Thanks.

Answer 1

One option is to install a tool that list to the kernel's file notifications (inotify). Then configure it to execute chattr as soon as the files and directories are created.

The example below use incrond (available in Debian and Red Hat/CentOS EPEL repo), but you may want to use a tool based on FAM, if you use an NFS export.

mkdir /srv/incrontest

Create the file /etc/incron.d/incrontest with the following content:

      /srv/incrontest IN_CREATE chattr +a $@/$#

Then (re)start the dameon systemctl start incron

(Make sure you systemctl enable incron if you live in RPM world)

Voilà