1

I wonder if it's possible to make files creatable, but not writable or removable. So that every file is created with r--r--r-- permissions.
My current smb.conf:

[global]
workgroup = WORKGROUP
server string = Samba Server %v
netbios name = ubuntu
security = user
map to guest = bad user
dns proxy = no

#=== Share Definitions ===

[Anonymous]
path = /samba/anon
browsable =yes
writable = yes
guest ok = yes
read only = no
force user = nobody
create mask = 0444
force create mode = 0444
directory mask = 0444
force directory mode = 0444

I'm stuck with /samba/anon permissions being set to drw-rw-rw-. If I remove the w, users can't create files anymore, with it - files are removable. Can this dilemma be solved?

Improve this question
2
  • Any reason your share as a read only = no setting? AFAIU, you want it set to yes. mask/mode options would only affect newly-created files, not prior existing ones.
    – SYN
    Oct 18, 2019 at 14:39
  • @SYN because it is same as removing w from permissions. Again, I need users to be able to create files there, but not delete or edit them
    – mekkanizer
    Oct 18, 2019 at 15:00

1 Answer 1

Reset to default
1
+50

You can try with the following (I cannot verify now it works but it should):

[Anonymous]
path = /samba/anon
browsable =yes
writable = yes
guest ok = yes
read only = no
force user = nobody
create mask = 0644
force create mode = 0644
directory mask = 3775
force directory mode = 3775
inherit owner = yes

Then set permissions on the share main directory (where sambaadm is some linux user different to nobody):

chown -R sambaadm:nogroup /samba/anon
find /samba/anon -type d | xargs chmod 3775
find /samba/anon -not -type d | xargs chmod 0644

This utilizes sticky bit on the directories to make files deletable only by owner. With "inherit owner" You force the user to be always sambaadm so deletes not possible for the nobody user. Also writes to files only allowed for sambaadm whereas the nobody users can write to the directories with their nogroup groupmembership.

Improve this answer
1
  • I just see.. the sgid on directory (so the leading 2 within 3 in directory permissions for the extra bist) is not really needed here, the important part is the extra bit 1 (sticky) for the directories and to ensure the file owners changed to "samabaadm" (or whatever user used)
    – user301446
    Oct 22, 2019 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .