0

If i wanted to create a directory that is owned by a user don and the group owner was a group called bob, would there be any way to:

  • Allow the group (bob) to have permissions to create and write to files
  • ONLY allow the owner of the directory (don) to delete files, no one else can delete them apart from the owner

I have tried using standard linux permissions and chmod etc. But this seems like a very trick task because granting write permissions allows groups to read and write, but it ALSO grants them to delete which i do not want.

How could i accomplish this maybe through standard Linux permissions or even ACL's?

1
  • AFAIK POSIX (so-called, because a draft existed but I'm not sure they can be found in modern POSIX documentation) ACLs don't have a specific delete permission. NFSv4 ACLs do. So unless it's over NFS, I'm not sure ACLs alone can help.
    – A.B
    Feb 19, 2023 at 12:10

1 Answer 1

0

To achieve this, you can use a combination of standard Linux permissions and Access Control Lists (ACLs).

First, you can create a directory with the following ownership and permissions:

mkdir testdir
chown don:bob testdir
chmod 2770 testdir

This sets the directory to be owned by user don and group bob, and grants the group bob read, write, and execute permissions, but restricts deletion by the group owner. The sticky bit 2 ensures that only the file owner or superuser can delete files in the directory.

Next, you can add an ACL to the directory to restrict deletion to the file owner only:

setfacl -m u:don:rwx testdir
setfacl -m g::--- testdir
setfacl -m o::--- testdir
setfacl -m d:u:don:rwx testdir
setfacl -m d:g::--- testdir
setfacl -m d:o::--- testdir

This gives user don full access to the directory, and removes any permissions for the group and other users. The d flag sets the default ACL for new files created in the directory.

With these settings, the group bob can create and write to files in the directory, but can't delete them. Only the owner don can delete files in the directory.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .