The owner of a directory is normally allowed to remove and rename files and subdirectories in that directory. Linux security modules and file attributes (if enabled and available) may add additional limitations.
Edited to reflect changes in the question:
A normal user can trivially create a directory that excludes all users except for themselves and root. For example:
mkdir -m 0700 ~/foo
creates a directory only accessible to the owner user (drwx------
) and root; whereas
mkdir -m 0770 ~/foo
creates a directory only accessible to the owner user and the members of the group (drwxrwx---
), and root.
With the exceptions set by whatever Linux security modules that might be in use (say, SELinux), root can access all files on a system. That's why they're the superuser, after all.
If you run command id -un
, you can see your current real user name. The command id -gn
reports your real group, and id -Gn
the names of the supplementary groups you are a member of. If you are the owner user of a directory, you can change the group of any file or subdirectory to any group you are a member of using the command chgrp
.
So, let's say you are user grand
and you belong to groups marina
and torino
. If you want to create directories games-marina
and games-torino
only you and whatever users that belong to those two groups can access (but others can only read, not modify or delete anything), then do
mkdir games-marina
chgrp marina games-marina
chmod u=rwx,g=rx,o= games-marina
mkdir games-torino
chgrp torino games-torino
chmod u=rwx,g=rx,o= games-torino
In many systems, users are also created a group matching their user name. This is in many ways useful; for example, it is usually the default group for any files you own, so it is explicit that only you control their contents.
A user cannot normally abandon files or directories for others to control. That kind of ownership change really requires superuser privileges. (For example, to change the owner of a file or directory using chown
, you need to either be root, or have the CAP_CHOWN capability in Linux.)
There are a number of reasons why letting such abandonment happen would be a bad idea; technically, it could be implemented, but I personally haven't seen any good use case yet. I am pretty certain the OP is trying to do something ... shall we say, non-useful, here.
(I do have written scripts that allow file ownership in certain directory trees between members belonging to a specific group -- yes, web administrators --, but that's pretty easy to safely set up with sudo
and a couple of bash/dash helper scripts.)
If we wanted to create directory /home/olegzandr/foo
that is not deletable by the owner of the directory /home/olegzandr
, we'd need to make foo
a mount point, and bind-mount a (root-owned) directory on top of it. For example, we could create directory /root/foo
(owned by the root user, obviously), and bind-mount it over /home/olegzandr/foo
using e.g.
sudo mount --bind /root/foo /home/olegzandr/foo
With a bind mount, the /home/olegzandr/foo
directory must still exist (as it is used as the mount point), and the owner of the /home/olegzandr
can manipulate that directory, but they cannot remove it while the bind mount exists. Since /home/olegzandr/foo
is a new mount point owned by root, the owner of /home/olegzandr
cannot manipulate it.
To protect the mount point from being removed by the owner of /home/olegzandr
while the bind mount is not in effect, one should set the mount point /home/olegzandr/foo
immutable. To create the initial mount point (without having the bind mount mounted yet), I'd use
sudo mkdir /home/olegzandr/foo
sudo chmod 0700 /home/olegzandr/foo
sudo chattr +i /home/olegzandr/foo
Note that this also means nobody can accidentally copy data or create subdirectories in /home/olegzandr/foo
, unless the bind mount is in effect. (When the bind mount is in effect, the owner, group, and permissions of /root/foo
apply to /home/olegzandr/foo
too.)
On ext4 and most other filesystems, we can usually use an intermediate immutable directory to create directory /home/olegzandr/foo/bar
, with /home/olegzandr/foo
being immutable. This way the owner of /home/olegzandr
cannot modify or delete /home/olegzandr/foo
, nor delete /home/olegzandr/foo/bar
. The latter is furthermore a sub-directory in a root-owned directory, and thus no longer under the thrall of the owner of /home/olegzandr
. To experiment with this:
sudo mkdir /home/olegzandr/foo
sudo mkdir /home/olegzandr/foo/bar
sudo chmod 0555 /home/olegzandr/foo
sudo chattr +i /home/olegzandr/foo
You can then set the owner, group, and mode of /home/olegzandr/foo/bar
as you wish. It cannot be deleted (even by root) as long as /home/olegzandr/foo
is immutable.
To change the immutable file attribute, one needs to be either root, or have the CAP_LINUX_IMMUTABLE
capability (which normally only root has).