SFTP: New files can be Create-But-Don't-Modify. How to do this with new directories?

Question

I've figured out how to accomplish a "create-but-don't-modify" permission scheme using SFTP. But it works for files only; I'd like to expand it to directories.

---

Background:

I have an SFTP server (OpenSSH-based) which confines a specific user group to a common chroot jail directory. The configuration is similar to that in this conversation.

I want users in this group to be able to create files and directories but not modify or delete them once created. I can't do this directly, as standard Linux permissions do not differentiate between "write" and "modify" permissions.

I can make it work by combining the SFTP root directory permissions with the umask option in the SFTP server configuration.

Permissions:

drwxr-xr-x  root  root       /sftproot
drwxrwxr-x  root  sftpgroup  /sftproot/upload_directory

/etc/ssh/sshd_config:

Subsystem sftp internal-sftp
Match Group sftponly
  ChrootDirectory /sftproot
  ForceCommand internal-sftp -d /upload_directory -u 0222

Note the -u 0222 switch. This applies a umask to newly-created files, which removes specific permissions.

---

Results:

When a user in the sftponly group uploads a new file, it is allowed because of the group-write directory permission. Then the umask option clears the 'w' bits, making the file non-modifiable. The file ends up looking like this:

-r--r--r--  {user}  sftponly  /sftproot/upload_directory/filename

Great! This is just what I want.

---

Problem:

The user can also create directories, which is also what I want. But, the newly-created directories also have their 'w' bits cleared, which prevents any new files from being written within.

---

Question:

How can I have the SFTP-created directories remain writable but keep the files read-only?

Any clever ideas?

Answer 1

Based on sftp-server (5) manpage, you can use the -u umask command line option to override user's umask:

     -u umask
             Sets an explicit umask(2) to be applied to newly-created files and directories, instead of
             the user's default mask.

So, just set the umask this way so that users don't have write permission anymore.

To set this, refer to sshd_config(5) manpage as mentionned in the sftp-server manpage:

     Command-line flags to sftp-server should be specified in the Subsystem declaration.  See
     sshd_config(5) for more information.