Prevent user to read files from vfat filesystems - but allow to write

Question

Its possible do that? I want to mount a flash drive(vfat) in linux and the user be able to write to it but not to read.

I've tried:

mount /dev/sdb1 /media/mpoint -o fmask=0444

but no results. After that I'm still able to read the files in the flash drive.

Answer 1

To solve that, you obviously need a better permission system than a FAT file system provides. That can be solved by using an overlay filesystem:

The FAT filesystem is mounted normally, and not accessible at all for the user.
The permissions are handled by a file system that stores it's files just as files on the FAT filesystem - but can implement additional features, like a permission system.
(I do not know which filesystem would match your needs - but I assume there is more than one that could be used, ignoring most of their features.)

That overlay- or union filesystem is what the user will access, and where you can set restricted permissions.
The permission system would be just the normal Unix/Linux style.
Using that, you can just set write-only permissions on all files and directories.
To navigate a directory, the user does not need to list the file- and directory names in it; But he needs to access the involved directories themselves - . and ...

You can allow just what he needs with a special kind of permission: Directories have the x permission like files - but are not executable in the first place. This unused directory execute permission is used to handle just what you need. If the r bit is not set, but the x is, the user can still read just the little bit he needs here.

Then, the user can not list them, but he can make use of directories he knows himself. He can **cd into** known directories.

To set the right permissions for new files, set a restrictive umask for the user.