12

I tried "chattr +i DIRNAME", it's great, but I cannot create files in the DIR after chattr. What else are there to prevent users from deleting a Directory?

root@HOST ~] mkdir test
[root@HOST ~] chattr +i test
[root@HOST ~] cd test
[root@HOST ~/test] touch sth
touch: cannot touch `sth': Permission denied
[root@HOST ~/test] cd ..
[root@HOST ~] chattr -i test
[root@HOST ~] cd test
[root@HOST ~/test] touch sth
[root@HOST ~/test] 

UPDATE: only the directory deletion is important, so I still need the files to be deleted in it

1
  • Take a look at /tmp and /var/tmp. While every user can create files there, he/she can delete only his own files/directories, but not the directory itselv.
    – Nils
    Nov 9 '12 at 21:50
16

Create a file ".protected" and do as root

chattr +i .protected

You can then delete all files except .protected within this directory, thus the directory can't be deleted by any other user.

6
  • Simple, and effective. Great answer.
    – Wug
    May 30 '16 at 5:10
  • It doesn't work in docker containers. :(
    – Kirby
    Jul 25 '18 at 11:44
  • 3
    To delete it, use "chattr -i [filename]" to remove the immutable attribute. Sep 16 '19 at 5:57
  • 1
    However, a user will still be able to move the directory to a completely other place up or down in the directory tree. For all intents or purposes, the end result may be equally dire. Jun 21 '20 at 12:40
3
chattr +a

should do the job. You can create files inside but you won't be able to delete them.

1
  • i updated the question Nov 9 '12 at 7:36
2

So what is wrong with a simple chown/chmod?:

cd /tmp
mkdir question
sudo chown root:root question
[sudo] password for user: 
chmod 777 ./question
touch sth
rm sth
cd ..
rm question -rf
rm: cannot remove `question': Operation not permitted

OK, let me tell you what is wrong with this: every user has all access to every file in the question directory due to the 777 permissions. It is better to

  • create a new group groupadd question
  • mkdir question
  • chown root:question ./question
  • chmod 770 ./question
  • add the users that must have access to the files to the new group: usermod -G group user

The important trick here is that the directory has a different owner than any of the users that will try to delete it.

5
  • 3
    It depends also where this directory is located. If somebody from question group has rwx rights on the directory containing question directory it will be able to delete it. Nov 9 '12 at 8:48
  • 1
    Add an extra sudo chmod o+t .. to set the t flag on the parent directory. The t flag will disallow to remove a file that is not owned by the user. t is commonly used on /tmp to do exactly that. UserA cannot delete files owned by UserB.
    – jippie
    Nov 9 '12 at 19:50
  • Or once again just put the correct ownership an permission bits on the directory.
    – jippie
    Nov 9 '12 at 19:52
  • It doesn't work in docker containers. :(
    – Kirby
    Jul 25 '18 at 11:44
  • Hey @jippie I'm trying to setup a SMB share and I have a backup directory with the following permissions: drwxr-x--T 1 admin users and the folder inside it is: drwxrwx--- 1 admin Elias. I've tried for so long but no matter what I do I can still delete the sub-directory. I must be doing something completely wrong. (I don't really care how I do it but I want a directory for every user, that only they can access, but the users are not allowed to delete the directory itself).
    – Elias
    Feb 15 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.