3

I would like to create a shared directory which should have write permissions for the particular group, but only the owner who creates the file should have write/delete on their own files.

For example,

mkdir /var/tmp/testdir
chown root:group1 /var/tmp/testdir
chmod 770 /var/tmp/testdir

If user1 creates a file in the directory,

su - user1
touch testfile1

Now, we don't want any other users to modify the file testfile1 which was created by user1. How to achieve this?

1 Answer 1

14

This is what the "sticky bit" or "restricted deletion flag" on a directory is for (see man chmod).

It's what is used for directories like /tmp/ and /var/tmp/ where all users are allowed to create, rename, and delete their own files but not those belonging to other users (reading and/or modifying the file itself still depends on the permissions of the file).

It is important to note that the file's owner, root, AND the directory's owner can delete (or rename) files in a directory with the sticky bit set. The owner because they own the file, the directory's owner because they own the dir, and root because they are root. If the dir is owned by root, then only root and the file's owner can rename or delete a file in it.

You can either add the sticky bit with chmod +t or use a 4 digit octal permissions code (+1000) when you first set the perms. e.g.

chmod 1770 /var/tmp/testdir

or

chmod +t /var/tmp/testdir
2
  • 1
    Expanding on the second para’s parenthetical, it’s probably worth noting that this addresses the “no modifications” part of the question when combined with typical permissions defaults (per-user primary groups, and umask denying writes for “other”). Jun 19, 2022 at 6:23
  • yes, having the umask (or default ACL!) properly set up is a part of this, even if it is usually correctly set up anyway.
    – ilkkachu
    Jun 19, 2022 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .