Is it possible to monitor user actions on the file system and prevent him from performing particular actions? Can inotify only monitor actions on the file system? What about fanotify? There's very little about it in Web...

My program (daemon) sends particular files over network. I want to make sure, that user will not delete or move my file however he cloud be able to read it. When user tries to delete my file with any program calling eg. unlink() I want to make this unlink() call will fail with some error (EACCES?). I can do similar trick implementing file system on FUSE, but it's not a solution here...

  • You could likely do it by registering a shell that will start other programs always with LD_PRELOAD and an .so that overrides unlink. This way you can limit it to that user and the respective implementation in the .so can limit it to whatever files or paths you want to secure. But the immutable attribute is the better choice as only root can remove it. – 0xC0000022L Mar 19 '14 at 12:17

What you're asking is easily achieved through traditional unix permissions. Make sure that the user can access the directory where the file is stored but not write to it (r-x permissions on the directory and its ancestors). Give the user read permission to the file, but not write permission (assuming the user shouldn't be able to modify the file), i.e. r--. With no write permission on the directory, the user won't be able to delete the file.

Monitoring won't help you there. It could tell you that the user deleted the file, but you can't prevent an action from happening merely by monitoring this action.

  • Ok, but I want to dynamically select "protected" files depending on user choices (user choices which file should be sent by my daemon). I should write it earlier... – Goofy Jan 8 '12 at 23:13

Although Gilles makes a good suggestion, another option (if, for example, you can't control the directory permissions) would be to set the immutable flag on the file, with chattr +i. This would prevent any user from writing to or deleting the file in question. Note that this requires root access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.