I would like to prevent a user (identified by uid) from creating and deleting files in /tmp
, but allow this user to create files in directory /tmp/hello
, which is owned by this user. How can I achieve that? Only this user should be prevented from creating and deleting files in /tmp
, other users whoever have the appropiate permission shouldn't be prevented. /tmp
is owned by root
.
1 Answer
You can do this using file ACLs.
You prevent the user badguy
from creating files in tmp
with:
setfacl -m u:badguy:r-x /tmp
And you can allow it to write to the hello
directory “normally” (allow everyone, chown
the directory to badguy
) or, again, with file ACLS:
setfacl -m u:badguy:rwx /tmp/hello
/tmp
is usually a quite special directory in that everyone is allowed to create files and directories in it. Is there a particular reason you'd want to disallow this user from creating files under/tmp
? Does it have to do with the location of temporary files? If so, does the software that you use honour theTMPDIR
environment variable (you would use it to specify another directory to create temporary files in). In short, what is the underlying problem that you are trying to solve?/tmp/hello
, and I want to make sure this program can only create files in the same directory of the program.