0

Is it possible to create a directory that its owner can't delete? Let's say I have directory bar owned by user foo, and I'd like to create a subdirectory bar/baz, also owned by foo, such that:

  • foo can create and remove files and directories in bar/baz as normal
  • foo can create and remove files in bar as normal
  • foo can remove most directories in bar as normal
  • foo (or any other non-superuser) CANNOT remove the directory bar/baz

The reason I'd like to do this is because I'd like to set up bar/baz as a BTRFS subvolume (to exclude it from snapshots), and if foo can remove it and recreate it using mkdir, then it would not be a subvolume anymore.

2
  • 1
    Once you mount the subvolume on baz I don't think anybody can delete that directory - they'll be sent packing with a resource in use error or something like that.
    – muru
    Commented Apr 8, 2022 at 3:07
  • @muru I don't believe this is true on recent enough versions of Linux. I can rm -rf a btrfs subvolume as a user if I own it and its parent dir.
    – Cactus
    Commented Apr 9, 2022 at 4:26

2 Answers 2

1

I can think of at least two ways to prevent an owner from deleting a directory.

  • A directory can't be deleted if it isn't empty. So put something in it the owner can't delete.
    • A directory they don't own
    • a file (owner doesn't matter) that is immutable
  • Mount something on the directory

In the first case, they'd still be able to rename the directory. But if something is mounted on it (which is what you want anyway), they can't do anything to it. Now if they can unmount what is on it...

3
  • I'm not sure what you mean by "you want that anyway". I'm not trying to mount a btrfs subvolume into this directory -- it is a btrfs subvolume.
    – Cactus
    Commented Apr 9, 2022 at 4:27
  • Maybe I misunderstood then. BTW, it is common to touch a file in a directory (like ".keep") to prevent it from being deleted. This will block rmdir but not rm -rf without the extra step of (root) making it immutable.
    – user10489
    Commented Apr 9, 2022 at 6:02
  • Indeed, touch dir2/.keep && chattr +i dir2/.keep (as root) seems to solve my problem!
    – Cactus
    Commented Apr 10, 2022 at 6:13
1

Deletion of either files or directories, requires permission to the parent directory.

Therefore if you have directories of /dir1/dir2, contents of dir2 do not matter, with the owner of dir1 set to user1, and the owner of dir2 set to user2, then user2 will not be able to either delete or rename dir2, regardless of whether there are files in dir2. Just look at /home. No user can delete their own home directory because root owns /home.

2
  • But in my case, both /dir1 and /dir1/dir2 should be owned by user1.
    – Cactus
    Commented Apr 9, 2022 at 4:26
  • Actually, it's not ownership that matters, but write access to both directories. But it would be rare to own the directory and not have write... and less rare to not own it and have write.
    – user10489
    Commented Apr 10, 2022 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .