0

I have files stored on an NFS mount which I want to prevent being deleted. The use case is I have a demo version of a web application which uses the same images on every demo - when someone deletes a record it deletes the associated images, files etc but I don't want these images to be removed as they are used by everyone. They should be able to delete other images etc but just not the ones I choose.

Previoulsy they were on local disk and I used:

chattr +i file

which worked a treat - I moved all the ifles to NFS and when I try this I now get:

chattr: Inappropriate ioctl for device while reading flags on file

At the moment I have a cron which runs every 15 mins and copies those files from an alternate directory back into the correct location which works but it is not ideal especially as it means that people signing up for a demo may see missing images inside that time window which looks rubbish. I could rewrite the application logic if I was really pushed but was hoping for something at a file system level which might work instead.

This reply (https://unix.stackexchange.com/a/90369/86224) suggested enabling ACL's but I am unable to do that and I cannot seem to get chmod to stop the files from being deleted:

-rw-r--r-- 1 owner owner 24751 Dec 23 16:30 file.ext

Is there an alternate way on NFS to stop a file being deleted?

Community
  • 1
bhttoan
  • 620
  • 3
  • 15
  • 26
  • Couldn't you just use `chattr` (or regular Unix file permissions) on the NFS server, to make those files immutable? – Christopher Karel Dec 23 '14 at 21:54
  • An easier option might be to alter your demo provisioninh to use symbolic or hard to its files. Then they all still fully work and can delete without affecting each other. – Grant Dec 23 '14 at 22:40

2 Answers2

2

I think this should work.

  1. Make the files to be protected are owned by root:root. eg chown root:root
  2. Make sure root_squash is enabled on the nfs mount.
  3. chmod 0644 the files.
  4. If you can get away with it, chown root:root the directory, and chmod 755 the directory. That's the only way to ensure it cannot be deleted by anyone other than root.

The owner--and usually anyone with write privileges--of a directory can usually override permissions to delete files in a directory, so if you have to give write permissions to the directory, all bets are off.

I know you said you couldn't enable them, but I would strongly recommend you look at ACLs. ACLs are beyond awesome for managing permissions in complex environments.

CVVS
  • 181
  • 1
  • 7
1

In /etc/exports use the ro option to only export the share as read only. 

/path/to/nfs webserver.com(ro)

If you have selective files that you want to protect as read only, I would suggest not going down the rabbit hole of ACLs and permissions modifications, and simply make a static assets mounts and export that as (ro).

Wesley
  • 32,320
  • 9
  • 80
  • 116
  • Hi Wesley - sorry I should have said I only want this to apply to a small number of files rather than all files – bhttoan Dec 23 '14 at 21:46