How can I protect a file from user changes?

Question

I am using Ubuntu 12.04 and I want to protect some pictures of another user using the su command (I have admin privileges). How can I protect a file using the terminal while still allowing the rest of the users to read it?

Answer 1

Ubuntu uses the EXT4 file-system format by default (I am assuming that we are not talking about anything else here).

If you do not want to take ownership of the file without removing the ability for the user to read that file you can start by allowing them to read, but not write to that file with:

chmod a-w,ug+r foo_file

^{description: change file permissions, all cannot write, user+group can read}

Then can make files immutable so that even users with root permission cannot change then by using the following:

sudo chattr +i foo_file

To be able to delete or even modify this file you would need to use the command:

sudo chattr -i foo_file

and then you will be able to do something with it.

The plus point of using this is that most users (and admins) never have experienced immutable files in Linux.

That was the user will see this when trying to remove (or alter) the file:

~> sudo chmod a-w,ug+r asd
~> ll asd
-r--r--r-- 1 bruno bruno 156 feb 21 20:46 asd
~> sudo chattr +i asd
~> chmod +w asd
chmod: changing permissions of ‘asd’: Operation not permitted
~> rm asd
rm: remove write-protected regular file ‘asd’? y
rm: cannot remove ‘asd’: Operation not permitted
~> sudo rm asd
rm: cannot remove ‘asd’: Operation not permitted

while still being able to read it:

~> cat asd
asd
...
Videos

After you issue chattr +i the file is "locked", no changes can be made until a user with root permissions sets it off with chattr -i.

Answer 2

Just use as below in your terminal(CTRL+ALT+T)

chmod 700 -R /path/to/directory

Answer 3

Try the below command on terminal,

chmod u-rw /path/to/directory

The above command won't allow the another user or group to read or write that directory where pictures are stored.

chmod u+rw /path/to/directory

To revert back the changes run the above command.

Answer 4

If you want to encrypt the file you can use bcrypt to encrypt and decrpt file. It uses blowfish file encryption .

type: sudo apt-get install bcrypt to install it.

After installation type sudo bcrypt file-name to encrypt it.

Answer 5

I recommend to use Truecrypt to create an encrypted "removable disk" to 1 file. If you create for example 1GB Truecrypt partition and you can protect this file with password. (Expert option: you can set 2 password for that file: with first password you see a normal part of file and with password 2 you see the hidden part) You can mount this file in Linux, Mac or in Windows (mount to drive e:) and you will show that 1GB file as like a pendrive/flash drive, and you can unmount when you want.

If you create that 1GB file (or any size, or a full disk or pendrive) you can add any extension for that file to hide. (Never place that file at your home directory as secret.truecrypt.file.with.pwd lol)

If you use any system file name in system folder maybe normal user never notice it's not a system file it's a private encrypted file.

For example for hide this file:

/usr/lib/libc8.2.so
/usr/lib/libxml24.so.9.1.3

Other temp filenames:

Win386.swp
nsz17BE.tmp
mmc00C1B00C.xml
jusched.log
IMT211.xml
i4j8470767517827925011.tmp
FTP7F0.tmp
e4j3B.tmp

• Choose one scheme and change numbers for a file name.

• and also set rights...and after done remove the history console commands

• With that solution normal user never will find your secret file.

• In Pendrive make a TEMP folder and use a temp file name, like file examples. and make few backups with different name...

You can install truecrypt if you want, for example:

sudo add-apt-repository ppa:michael-astrapi/ppa
sudo apt-get update
sudo apt-get install truecrypt

More information in Truecrypt homepage

Answer 6

If by protect, you mean prevent any modifications to these files at all, consider using the chattr utility. It has the option mark files as immutable (unable to be changed).

chattr +i /home/username/pictures/example1.png

This will prevent all users and even the root user from removing or modifying any files set as immutable.

You can reverse this action by replacing the "+i" with "-i".