12

I tried "chattr +i DIRNAME", it's great, but I cannot create files in the DIR after chattr. What else are there to prevent users from deleting a Directory?

root@HOST ~] mkdir test
[root@HOST ~] chattr +i test
[root@HOST ~] cd test
[root@HOST ~/test] touch sth
touch: cannot touch `sth': Permission denied
[root@HOST ~/test] cd ..
[root@HOST ~] chattr -i test
[root@HOST ~] cd test
[root@HOST ~/test] touch sth
[root@HOST ~/test]

UPDATE: only the directory deletion is important, so I still need the files to be deleted in it

1
  • Take a look at /tmp and /var/tmp. While every user can create files there, he/she can delete only his own files/directories, but not the directory itselv.
    – Nils
    Nov 9, 2012 at 21:50

3 Answers 3

Reset to default
16

Create a file ".protected" and do as root

chattr +i .protected

You can then delete all files except .protected within this directory, thus the directory can't be deleted by any other user.

6
  • Simple, and effective. Great answer.
    – Wug
    May 30, 2016 at 5:10
  • It doesn't work in docker containers. :(
    – Kirby
    Jul 25, 2018 at 11:44
  • 3
    To delete it, use "chattr -i [filename]" to remove the immutable attribute.
    – emeraldhieu
    Sep 16, 2019 at 5:57
  • 1
    However, a user will still be able to move the directory to a completely other place up or down in the directory tree. For all intents or purposes, the end result may be equally dire.
    – Serge Stroobandt
    Jun 21, 2020 at 12:40
  • Here is how to prevent the directory from moving.
    – Serge Stroobandt
    Jun 21, 2020 at 17:07
4 
chattr +a

should do the job. You can create files inside but you won't be able to delete them.

1
  • i updated the question
    – gasko peter
    Nov 9, 2012 at 7:36
2

So what is wrong with a simple chown/chmod?:

cd /tmp
mkdir question
sudo chown root:root question
[sudo] password for user: 
chmod 777 ./question
touch sth
rm sth
cd ..
rm question -rf
rm: cannot remove `question': Operation not permitted

OK, let me tell you what is wrong with this: every user has all access to every file in the question directory due to the 777 permissions. It is better to

  • create a new group groupadd question
  • mkdir question
  • chown root:question ./question
  • chmod 770 ./question
  • add the users that must have access to the files to the new group: usermod -G group user

The important trick here is that the directory has a different owner than any of the users that will try to delete it.

5
  • 3
    It depends also where this directory is located. If somebody from question group has rwx rights on the directory containing question directory it will be able to delete it.
    – Laurentiu Roescu
    Nov 9, 2012 at 8:48
  • 1
    Add an extra sudo chmod o+t .. to set the t flag on the parent directory. The t flag will disallow to remove a file that is not owned by the user. t is commonly used on /tmp to do exactly that. UserA cannot delete files owned by UserB.
    – jippie
    Nov 9, 2012 at 19:50
  • Or once again just put the correct ownership an permission bits on the directory.
    – jippie
    Nov 9, 2012 at 19:52
  • It doesn't work in docker containers. :(
    – Kirby
    Jul 25, 2018 at 11:44
  • Hey @jippie I'm trying to setup a SMB share and I have a backup directory with the following permissions: drwxr-x--T 1 admin users and the folder inside it is: drwxrwx--- 1 admin Elias. I've tried for so long but no matter what I do I can still delete the sub-directory. I must be doing something completely wrong. (I don't really care how I do it but I want a directory for every user, that only they can access, but the users are not allowed to delete the directory itself).
    – Elias
    Feb 15, 2021 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .