I want to disable the possibility of a permission change for a directory, so for example users couldn't peek into other users home directories.

Is it possible without taking away the ownership? Even the owner shouldn't be allowed to change permissions (otherwise he could restore previous flags removed by the root).

I only came up with a solution that changes the directory ownership; then I can leave only group permissions, but I do not know if there are any negative side effects with this solution?

  • There's no separate permissions that just governs the ability to change permissions. Changing the ownership is the best solution. – Barmar May 24 '17 at 19:12
  • What does the ability to change permissions have to do with looking into other users' directories? – Barmar May 24 '17 at 19:14
  • This is just an example. Let's take two students, who are taking a midterm. Each should work alone, but without correct permissions on their home directories each of them will be able to look at their peers work. If I, as root, will somehow be able to allow only the owner to access his home directory, the problem is solved. The problem is that the owner can reverse permissions set by the root. – Kamil May 24 '17 at 19:42
  • So you want to prevent student A from allowing student B to look at his work? If A wants to help B cheat, all he has to do is email him his work, or call him on the phone, etc. Permissions can really only be used to keep out unwanted viewers, trying to use it to prevent intentional collusion will not be effective. – Barmar May 24 '17 at 19:46
  • In small groups, when an assistant is keeping an eye on students, he can tell that the thing on a monitor is an e-mail application/web browser and not the code; but it is hard to tell whose code is it :) It is a part of a solution and an interesting question by itself ;) – Kamil May 24 '17 at 19:51

Another option is to make the directory immutable using chattr:

[mehlsec@localhost ~]$ sudo chattr +i /directory
  • 1
    No, this is not the answer. The +i, immutable flag disable permission changes, but it also prevent user from creating files inside the directory, etc. (it should be fully functional after the process) – Kamil May 24 '17 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.