3

I currently have chroot users whos home directories contain both an 'upload' directory and a 'download' directory.

Originally the permissions on the upload directory where

chown user:sftpadmin upload
chmod 370 upload

and the permissions on the download directory where

chown user:sftpadmin download
chmod 570 dowload

The purpose of the sftpadmins group is for service accounts that are a member of this group would be able to place/retrieve files for the user from the respective directories.

Now we have a request to allow the users the ability to delete files in the download directory after they are finished with them. However the only option I can come up with to accomplish this is setting the permissions on the download dir to

chmod 770 download

However this would grant the chroot'ed users the ability to write any file to this directory, which I would like to avoid.

Is there any combination of permissions I can set that would allow them the ability to read, download, and delete the files in the directory, without allowing them to write files to the download directory?

It would look something like:

  • Allow user to remove (delete) a file
  • Will not allow user to change the file.
  • Will not allow user to add a file to the directory.
1

Well it depends:

It's not possible with standard posix permissions, as deleting a file needs the same permission as adding: write permission on the containing directory.

If however your file system supports NFSv4 access control lists (e.g. ZFS) it is possible, as there exist the distinct control entries "write-data" (-> create files) and delete-child. You just have to set the "allow delete-child" entry on the directory for the particular user, but not the "allow write-data" entry (or instead: set "deny write-data").

See https://linux.die.net/man/5/nfs4_acl for a detailed description

0

Basically, yes it is a combination of privileges that:

  • will allow to remove a file,
  • will not allow to change the file.

Removing and adding files are defined by directory permissions, but modifying files are defined by file permissions.

Example:

➜ example mkdir -pv sample ➜ example touch sample/file.txt ➜ example chmod 0700 sample; chmod 0400 sample/file.txt ➜ example echo 'sample' > sample/file.txt zsh: permission denied: sample/file.txt ➜ example rm -f sample/file.txt ➜ example

  • 1
    Granting a 7 for the user on the directory would allow the user to upload files, correct? This is what I am trying to avoid. I think I can add one other bullet point to your breakdown that I've added to the original post. Thank you for the assistance. – cy10n May 10 '17 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.