Prevent deletion of folder but let access to everything inside of it

Question

I know there is the +i flag for files and directories, but i have a deeper Problem.

Is there a way to prevent a folder from being deleted by an User which should be able to create / access / remove files and folders INSIDE the delete-protected folder?

The sudo chattr +i testfolder flag wont help because then a user can only read files, but not create or delete these.

The sudo chattr +a testfolder flag wonth either help because then a user can write and read files, but only append edit files and dont remove them.

I need a solution where a user is able to write, access and remove Files but can't delete the root/parent folder.

gogators · Answer 1 · 2016-02-15T14:39:00.797

2

This is basically what the /tmp folder is for. So just set the permissions that same as /tmp:

chmod --reference=/tmp testfolder

The testfolder should be owned by a different user (e.g. root). The user will be able to wrx files and folders under testfolder, but will not be able to remove or modify the testfolder.

For example:

[root@host ~]# mkdir /test
[root@host ~]# chmod --reference=/tmp /test
[root@host ~]# ls -ld /test
drwxrwxrwt 2 root root 4096 Feb 15 09:33 /test/
[root@host ~]# su - user
[user@host ~]$ mkdir /test/foo
[user@host ~]$ rm -fr /test
rm: cannot remove `/test': Permission denied

As you can see, user can create files and dirs under /test, but is not allowed to remove it.

edited Feb 15 '16 at 14:39

answered Feb 15 '16 at 12:09

gogators

226
2
8

Thanks for your solution, but the user is still able to remove the folder ... – fechnert Feb 15 '16 at 13:29
The user must not be the owner of testfolder or its parent. – gogators Feb 15 '16 at 13:34
Exactly this was the case. Try it yourself – fechnert Feb 15 '16 at 14:30
I updated the answer with an example that show the user can not remove the directory. – gogators Feb 15 '16 at 14:39
1

@kevin-vw It depends on permissions of parent folder – Laurentiu Roescu Feb 15 '16 at 15:19

Prevent deletion of folder but let access to everything inside of it

1 Answers1