I am using Ubuntu 12.04 and I want to protect some pictures of another user using the su command (I have admin privileges). How can I protect a file using the terminal while still allowing the rest of the users to read it?
-
I want that anyone can view it bot cannot edit of delete it– JattttFeb 22, 2014 at 8:31
-
@user222588 sounds clear enough, no worries– Bruno PereiraFeb 22, 2014 at 9:51
-
The method depends where are the files, where they are? An usb, your main hard drive?– BraiamFeb 23, 2014 at 0:30
6 Answers
Ubuntu uses the EXT4 file-system format by default (I am assuming that we are not talking about anything else here).
If you do not want to take ownership of the file without removing the ability for the user to read that file you can start by allowing them to read, but not write to that file with:
chmod a-w,ug+r foo_file
description: change file permissions, all cannot write, user+group can read
Then can make files immutable so that even users with root permission cannot change then by using the following:
sudo chattr +i foo_file
To be able to delete or even modify this file you would need to use the command:
sudo chattr -i foo_file
and then you will be able to do something with it.
The plus point of using this is that most users (and admins) never have experienced immutable files in Linux.
That was the user will see this when trying to remove (or alter) the file:
~> sudo chmod a-w,ug+r asd
~> ll asd
-r--r--r-- 1 bruno bruno 156 feb 21 20:46 asd
~> sudo chattr +i asd
~> chmod +w asd
chmod: changing permissions of ‘asd’: Operation not permitted
~> rm asd
rm: remove write-protected regular file ‘asd’? y
rm: cannot remove ‘asd’: Operation not permitted
~> sudo rm asd
rm: cannot remove ‘asd’: Operation not permitted
while still being able to read it:
~> cat asd
asd
...
Videos
After you issue chattr +i
the file is "locked", no changes can be made until a user with root permissions sets it off with chattr -i
.
-
-
Fantastic feature. "most users (and admins) never have experienced immutable files" how very true! I've been a Linux system admin for 20+ years and I'd never heard of it.– MartinMar 17, 2023 at 16:40
Just use as below in your terminal(CTRL+ALT+T)
chmod 700 -R /path/to/directory
-
whats wrong with this ? negative vote with a proper reason much appreciated.– Raja GFeb 22, 2014 at 9:17
Try the below command on terminal,
chmod u-rw /path/to/directory
The above command won't allow the another user or group to read or write that directory where pictures are stored.
chmod u+rw /path/to/directory
To revert back the changes run the above command.
-
1
-
2I'd imagine the downvote is because you're taking rights away from the owner, not other users and groups. Feb 22, 2014 at 0:01
If you want to encrypt the file you can use bcrypt
to encrypt and decrpt file. It uses blowfish file encryption .
type:
sudo apt-get install bcrypt
to install it.
After installation type sudo bcrypt file-name
to encrypt it.
I recommend to use Truecrypt to create an encrypted "removable disk" to 1 file.
If you create for example 1GB Truecrypt partition and you can protect this file with password. (Expert option: you can set 2 password for that file: with first password you see a normal part of file and with password 2 you see the hidden part)
You can mount this file in Linux, Mac or in Windows (mount to drive e:
) and you will show that 1GB file as like a pendrive/flash drive, and you can unmount when you want.
If you create that 1GB file (or any size, or a full disk or pendrive) you can add any extension for that file to hide. (Never place that file at your home directory as secret.truecrypt.file.with.pwd lol)
If you use any system file name in system folder maybe normal user never notice it's not a system file it's a private encrypted file.
For example for hide this file:
/usr/lib/libc8.2.so
/usr/lib/libxml24.so.9.1.3
Other temp filenames:
Win386.swp
nsz17BE.tmp
mmc00C1B00C.xml
jusched.log
IMT211.xml
i4j8470767517827925011.tmp
FTP7F0.tmp
e4j3B.tmp
Choose one scheme and change numbers for a file name.
and also set rights...and after done remove the history console commands
With that solution normal user never will find your secret file.
In Pendrive make a TEMP folder and use a temp file name, like file examples. and make few backups with different name...
You can install truecrypt if you want, for example:
sudo add-apt-repository ppa:michael-astrapi/ppa
sudo apt-get update
sudo apt-get install truecrypt
More information in Truecrypt homepage
If by protect, you mean prevent any modifications to these files at all, consider using the chattr utility. It has the option mark files as immutable (unable to be changed).
chattr +i /home/username/pictures/example1.png
This will prevent all users and even the root user from removing or modifying any files set as immutable.
You can reverse this action by replacing the "+i" with "-i".