1

This is the scenario

  1. There is one directory /test which is owned by oracle.dba
  2. I created new user TEST who will have permission to create NEW files but it should not be able to delete the files he/she created

I tried multiple ways even acls but not working.

9
  • 1
    You're right. If you want the users to be able to create new files then they will always be able to delete them if the permissions or ownership don't change. May 30, 2016 at 8:18
  • Yes, it allows to change the content of file but even owner cant delete the file.
    – OmiPenguin
    May 30, 2016 at 8:38
  • Linux is limited in this area. I am working to extend that.
    – user140866
    May 30, 2016 at 8:53
  • Duplicate of unix.stackexchange.com/questions/55259/… ?
    – xenoid
    May 30, 2016 at 9:15
  • 1
    not really doable...removing and creating a file depends on the permissions of the parent folder, and if a user can create a file he will be able to remove it as well, even if he has 0 permissions on it (when using umask 777)
    – magor
    May 30, 2016 at 9:42

1 Answer 1

1

I believe there is no way of doing this using just standard UNIX privileges. The problem here is that (as far as I know) a newly created file is always owned by its creator — and if you are able to create the file, you have write privileges to the parent directory, and can therefore delete the file as well.

You can use the sticky bit to prevent users from deleting other users files, and you can use the SETGID bit on the directory to change the group of newly created files, but on Linux, the SETUID directory bit is ignored.

You could create a daemon that monitors the directory (perhaps using some kind of file alteration monitor) and changes ownership to oracle.dba after the file is created. There is a race condition, though – an attacker can delete the file before the daemon notices it's there.

And even if you succeed, be aware that as long as you have write permissions, you can truncate the file to zero length, thus destroying the contents without having to explicitly delete the file.

6
  • Yes, thats the problem SUID is not working on new files. sticky bit only works with SGID. At this moment my weak mind tells me to use "chattr +i" .
    – OmiPenguin
    May 30, 2016 at 9:26
  • @OmiPenguin I don't see how chattr will help you. If you are willing to change permissions on files after they are created, you can just go for the chmod I've proposed. chattr +i will prevent you from modifying the file at all, which is probably not what you want.
    – Jonas
    May 30, 2016 at 9:38
  • "chattr +i" will allow me to modify the files, but will not permit to delete any file not even root user will be able to delete them, So to delete a file i have to set chattr to none to delete file , then after deleting files i reset chatter to "chattr +i"
    – OmiPenguin
    May 30, 2016 at 9:57
  • Why do you answer a question that you agree can't be answered? OP needs to learn how permissions and ownership works. I actually have a much better solution to allow file creation without giving ownership but it wouldn't answer the question either which is why I don't post it. May 30, 2016 at 15:55
  • @JuliePelletier I feel that “this can't be done under these circumstances” is a valuable answer. If you have a better solution, why don't you post it? I'd like to know how to do this without resorting to ugly hacks.
    – Jonas
    May 30, 2016 at 17:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .