How can I make a write-only view of a folder?

Question

I want to have a place on the filesystem that presents a write-only "view" of another folder that I have read-write access to.

I'm picturing something that's similar in behavior to an FTP drop box, where files can be copied into it but not read out of it, e.g.:

$ ls read-write-view/ write-only-view/
read-write-view/:
a  b  c

write-only-view/:

$ cp d write-only-view/
$ ls read-write-view/ write-only-view/
read-write-view/:
a  b  c  d

write-only-view/:

It's important that this works as in the example — the contents are still visible when accessed through read-write-view/, and both "views" are functional for a single user.

How can I set something like this up? Some clever arrangement of symbolic links, perhaps? Or an unusual configuration of a bind mount?

Answer 1

I asked this same question for student drop boxes on the samba mailing list a few years back (http://lists.samba.org/archive/samba/2008-September/143610.html) and the answer has worked for us. You need extended acl attributes on your filesystem (from the acl package), here's Jeremy Allison's answer...

Ok, the problem is that students need to be able to read the containing directory in order to be able to drag and drop new files there. The reason is that Samba needs to be able to scan the directory on their behalf in order to do case insensitive lookups.

But so long as you don't mind allowing the students to see the names of each others files, you can set up a DropBox so that students can write into it (and their own files) but not edit or see others files.

Firstly, you want to make sure that files created in the DropBox directory are not owned by the student's primary group, but by the group owner of the DropBox direcotry. So :

chgrp teachers DropBox

to make it owned by the teachers group. Then set the setgid bit on the DropBox directory to make sure that files created within there have an owning group of teachers.

chmod g+s DropBox

Then ensure that a file in DropBox can be renamed or deleted by only the owner of the file, or by the owner of the directory, or by root (same permissions that /tmp has).

chmod +t DropBox

Then allow students to write into the directory by adding an ACL

setfacl -m g:students:rwx DropBox

So long as the defaul acl is set so that "others" have no permissions, files written by a student into that directory will be owned by themselves but will have an owning group of "teachers", and students will not be able to read each others files.

If you need to be cause the files to be owned by the owner of the directory, not by the students who created them you need to set up a separate share as described above, but then add the share level parameter :

inherit owner = yes

which will cause files created within the directories in that share to be owned by the containing directory, not the creating owner.

Answer 2

You can achieve some of this by setting the permissions on the folder such that the target users have write access to the folder but not read access.

For example, to allow anyone to write to a folder but not list its contents, you could do the following:

chmod o=wx folder

Or to only give a particular group of users this access:

chgrp groupname folder
chmod o=,g=wx folder

Now those users will not be able to list the contents of the folder but will be able to place files in the folder:

$ ls folder
ls: cannot open directory folder: Permission denied
$ touch folder/filename

This doesn't do everything you want, since if users can still access files in the folder if they can guess the name. You could minimise this risk through a cron job that regularly moved files out of the drop box folder to a location that other users have no access to.

Answer 3

You can create a drop folder "write-only-view" with rw access and use cronjob or inode notification to move the content to the other "read-write-view".

Answer 4

I believe you could simply use bind mount trickery, in /etc/fstab:

/path/to/read-write-view /path/to/write-only-view none bind 0 0

So, you could probably then:

chmod a=wx /path/to/write-only-view
chmod a=rwx /path/to/read-write-view

Answer 5

Use bindfs, which is designed to "mount a directory to another location and alter permission bits."

Start with a normal folder that has both read and write access:

$ mkdir read-write-view && touch read-write-view/{a,b,c}
$ ls read-write-view
a  b  c

Use bindfs to mount the folder without read access:

$ mkdir write-only-view
$ sudo bindfs --perms=a-r read-write-view write-only-view

Verify that only the contents of the original folder can be listed:

$ ls read-write-view write-only-view
read-write-view:
a  b  c
ls: cannot open directory write-only-view: Permission denied

Verify that the original folder can be written to through the mount:

$ echo 'Can you read this?' > write-only-view/d
$ cat read-write-view/d
Can you read this?

Verify that files cannot be read through the mount:

$ cat write-only-view/d
cat: write-only-view/d: Permission denied

Answer 6

First, it is easier to think of this in reverse. You have a folder that is rw for whoever needs write access, and a readonly "view" of this folder for those that need read-only access.

I have never been able to get the mount --bind -o ro option to work correctly.The most reliable way to do this is to use nfs. Add the following to /etc/exports

/path-to-folder/folder 127.0.0.1(secure,ro,no_root_squash)

then mount the read-only "view" with

mount -o ro 127.0.0.1:/path-to-folder/folder /read-only-folder

You should now have a read only view of your original folder.

I suppose you could do the same thing with samba/cifs, but this would only really make sense for network access.

This solution was inspired by (stolen from) this Howto. I hope it helps.

Answer 7

I don't think this is possible, since you have to read a "write only" disk to display the contents.

If I were to sell such a device, how would anyone be able to verify that it worked? Maybe this is one for kickstarter.

Answer 8

This is not an answer, but really more a thought and possibly another question. To me this sounds as if it can be implemented through some sort of hook or trigger.

Some program in the background might watch the write-only folder (not by polling, it can be notified with FAM or something like that) and then move each file out of it into the read-only folder as soon as it appears.