Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to have a place on the filesystem that presents a write-only "view" of another folder that I have read-write access to.

I'm picturing something that's similar in behavior to an FTP drop box, where files can be copied into it but not read out of it, e.g.:

$ ls read-write-view/ write-only-view/
read-write-view/:
a  b  c

write-only-view/:

$ cp d write-only-view/
$ ls read-write-view/ write-only-view/
read-write-view/:
a  b  c  d

write-only-view/:

It's important that this works as in the example — the contents are still visible when accessed through read-write-view/, and both "views" are functional for a single user.

How can I set something like this up? Some clever arrangement of symbolic links, perhaps? Or an unusual configuration of a bind mount?

share|improve this question
add comment

8 Answers

You can achieve some of this by setting the permissions on the folder such that the target users have write access to the folder but not read access.

For example, to allow anyone to write to a folder but not list its contents, you could do the following:

chmod o=wx folder

Or to only give a particular group of users this access:

chgrp groupname folder
chmod o=,g=wx folder

Now those users will not be able to list the contents of the folder but will be able to place files in the folder:

$ ls folder
ls: cannot open directory folder: Permission denied
$ touch folder/filename

This doesn't do everything you want, since if users can still access files in the folder if they can guess the name. You could minimise this risk through a cron job that regularly moved files out of the drop box folder to a location that other users have no access to.

share|improve this answer
add comment

You can create a drop folder "write-only-view" with rw access and use cronjob or inode notification to move the content to the other "read-write-view".

share|improve this answer
add comment

I believe you could simply use bind mount trickery, in /etc/fstab:

/path/to/read-write-view /path/to/write-only-view none bind 0 0

So, you could probably then:

chmod a=wx /path/to/write-only-view
chmod a=rwx /path/to/read-write-view
share|improve this answer
add comment

First, it is easier to think of this in reverse. You have a folder that is rw for whoever needs write access, and a readonly "view" of this folder for those that need read-only access.

I have never been able to get the mount --bind -o ro option to work correctly.The most reliable way to do this is to use nfs. Add the following to /etc/exports

/path-to-folder/folder 127.0.0.1(secure,ro,no_root_squash)

then mount the read-only "view" with

mount -o ro 127.0.0.1:/path-to-folder/folder /read-only-folder

You should now have a read only view of your original folder.

I suppose you could do the same thing with samba/cifs, but this would only really make sense for network access.

This solution was inspired by (stolen from) this Howto. I hope it helps.

share|improve this answer
    
I'm not asking about a read-only view, just read-write and write-only. –  ændrük May 15 '12 at 19:26
add comment

I asked this same question for student drop boxes on the samba mailing list a few years back (http://lists.samba.org/archive/samba/2008-September/143610.html) and the answer has worked for us. You need extended acl attributes on your filesystem (from the acl package), here's Jeremy Allison's answer...

Ok, the problem is that students need to be able to read the containing directory in order to be able to drag and drop new files there. The reason is that Samba needs to be able to scan the directory on their behalf in order to do case insensitive lookups.

But so long as you don't mind allowing the students to see the names of each others files, you can set up a DropBox so that students can write into it (and their own files) but not edit or see others files.

Firstly, you want to make sure that files created in the DropBox directory are not owned by the student's primary group, but by the group owner of the DropBox direcotry. So :

chgrp teachers DropBox

to make it owned by the teachers group. Then set the setgid bit on the DropBox directory to make sure that files created within there have an owning group of teachers.

chmod g+s DropBox

Then ensure that a file in DropBox can be renamed or deleted by only the owner of the file, or by the owner of the directory, or by root (same permissions that /tmp has).

chmod +t DropBox

Then allow students to write into the directory by adding an ACL

setfacl -m g:students:rwx DropBox

So long as the defaul acl is set so that "others" have no permissions, files written by a student into that directory will be owned by themselves but will have an owning group of "teachers", and students will not be able to read each others files.

If you need to be cause the files to be owned by the owner of the directory, not by the students who created them you need to set up a separate share as described above, but then add the share level parameter :

inherit owner = yes

which will cause files created within the directories in that share to be owned by the containing directory, not the creating owner.

share|improve this answer
add comment

I don't think this is possible, since you have to read a "write only" disk to display the contents.

If I were to sell such a device, how would anyone be able to verify that it worked? Maybe this is one for kickstarter.

share|improve this answer
add comment

This is not an answer, but really more a thought and possibly another question. To me this sounds as if it can be implemented through some sort of hook or trigger.

Some program in the background might watch the write-only folder (not by polling, it can be notified with FAM or something like that) and then move each file out of it into the read-only folder as soon as it appears.

share|improve this answer
add comment
up vote 0 down vote accepted

Use bindfs, which is designed to "mount a directory to another location and alter permission bits."

Start with a normal folder that has both read and write access:

$ mkdir read-write-view && touch read-write-view/{a,b,c}
$ ls read-write-view
a  b  c

Use bindfs to mount the folder without read access:

$ mkdir write-only-view
$ sudo bindfs --perms=a-r read-write-view write-only-view

Verify that only the contents of the original folder can be listed:

$ ls read-write-view write-only-view
read-write-view:
a  b  c
ls: cannot open directory write-only-view: Permission denied

Verify that the original folder can be written to through the mount:

$ echo 'Can you read this?' > write-only-view/d
$ cat read-write-view/d
Can you read this?

Verify that files cannot be read through the mount:

$ cat write-only-view/d
cat: write-only-view/d: Permission denied
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.