10

I tried "chattr +i DIRNAME", it's great, but I cannot create files in the DIR after chattr. What else are there to prevent users from deleting a Directory?

root@HOST ~] mkdir test
[root@HOST ~] chattr +i test
[root@HOST ~] cd test
[root@HOST ~/test] touch sth
touch: cannot touch `sth': Permission denied
[root@HOST ~/test] cd ..
[root@HOST ~] chattr -i test
[root@HOST ~] cd test
[root@HOST ~/test] touch sth
[root@HOST ~/test] 

UPDATE: only the directory deletion is important, so I still need the files to be deleted in it

  • Take a look at /tmp and /var/tmp. While every user can create files there, he/she can delete only his own files/directories, but not the directory itselv. – Nils Nov 9 '12 at 21:50
2

So what is wrong with a simple chown/chmod?:

cd /tmp
mkdir question
sudo chown root:root question
[sudo] password for user: 
chmod 777 ./question
touch sth
rm sth
cd ..
rm question -rf
rm: cannot remove `question': Operation not permitted

OK, let me tell you what is wrong with this: every user has all access to every file in the question directory due to the 777 permissions. It is better to

  • create a new group groupadd question
  • mkdir question
  • chown root:question ./question
  • chmod 770 ./question
  • add the users that must have access to the files to the new group: usermod -G group user

The important trick here is that the directory has a different owner than any of the users that will try to delete it.

| improve this answer | |
  • 3
    It depends also where this directory is located. If somebody from question group has rwx rights on the directory containing question directory it will be able to delete it. – Laurentiu Roescu Nov 9 '12 at 8:48
  • 1
    Add an extra sudo chmod o+t .. to set the t flag on the parent directory. The t flag will disallow to remove a file that is not owned by the user. t is commonly used on /tmp to do exactly that. UserA cannot delete files owned by UserB. – jippie Nov 9 '12 at 19:50
  • Or once again just put the correct ownership an permission bits on the directory. – jippie Nov 9 '12 at 19:52
  • It doesn't work in docker containers. :( – Kirby Jul 25 '18 at 11:44
12

Create a file ".protected" and do as root

chattr +i .protected

You can then delete all files except .protected within this directory, thus the directory can't be deleted by any other user.

| improve this answer | |
  • Simple, and effective. Great answer. – Wug May 30 '16 at 5:10
  • It doesn't work in docker containers. :( – Kirby Jul 25 '18 at 11:44
  • 2
    To delete it, use "chattr -i [filename]" to remove the immutable attribute. – emeraldhieu Sep 16 '19 at 5:57
  • 1
    However, a user will still be able to move the directory to a completely other place up or down in the directory tree. For all intents or purposes, the end result may be equally dire. – Serge Stroobandt Jun 21 at 12:40
3
chattr +a

should do the job. You can create files inside but you won't be able to delete them.

| improve this answer | |
  • i updated the question – gasko peter Nov 9 '12 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.