21

How can I use, preferably a single chmod command, which will allow any user to create a file in a directory but only the owner of their file (the user who created it) can delete their own file but no one else's in that directory.

I was thinking to use: 

chmod 755 directory

As the user can create a file and delete it, but won't that allow the user to delete other people's files?

I only want the person who created the file to be able to delete their own file. So, anyone can make a file but only the person who created a file can delete that file (in the directory).

Improve this question

2 Answers 2

Reset to default
35

The sticky bit can do more or less what you want. From man 1 chmod:

The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the directory; this is called the restricted deletion flag for the directory, and is commonly found on world-writable directories like /tmp.

That is, the sticky bit's presence on a directory only allows contained files to be renamed or deleted if the user is either the file's owner or the containing directory's owner (or the user is root).

You can apply the sticky bit (which is represented by octal 1000, or t) like so:

# instead of your chmod 755
chmod 1777 directory

# or, to add the bit to an existing directory
chmod o+t directory
Improve this answer
0
15

Most /tmp directories are created with that type of permission set.

You want the world "sticky" bit. The symbolic way of setting that bit is:

# chmod ugo+w,+t directory

The "modal" way is:

# chmod 1777 directory
# ls -ld directory
drwxrwxrwt  2 root  wheel  2 Oct 21 17:06 directory/
Improve this answer
3
  • so the +t is like a flag with an extra bit of information on top of the rwx permissions telling it is 'sticky', which means only the owner of the file can delete it?
    – Matt
    Commented Oct 22, 2019 at 0:36
  • 2
    Yes, there are more bits than the 9 ones used for the normal file permissions (suid, sguid, sticky). Initially the sticky bit was for executable files, but it was repurposed for directories to mean „delete permission on this directory requires owner to match“. It should be mentioned that’s quite tricky to make it securely and usually if you want to implement a shared storage area it’s better to work with User owned subdirectories to avoid some of the race conditions. Systemd has some features to create a process specific temp mount for this reason.
    – eckes
    Commented Oct 22, 2019 at 9:44
  • 2
    @Mandingo Once upon a time, this permission could also be used on executables. It caused the program to remain in swap (as a loaded process?), so it didn't have to be loaded in from disk everytime - it "stuck" in swap... hence "sticky-bit". This functionality was however removed from the Linux and most (all?) Unix kernels long ago (ie. beginning of the 2000s or so).
    – Baard Kopperud
    Commented Oct 22, 2019 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .