2

I have created a directory named demo and gave read, write and execute to a user named demoUser.

What I want is the user to be able to read, write and execute the files of the demo directory, but not be able to delete any of the files. Is that possible?

I tried a technique in which I created 3 Groups: reader, editor and admin. I gave read permission to the reader group and edit permission to the editor group using:

setfacl OPTION X:NAME:Y /DIRECTORY

Now I added demoUser to the editor group. The user can read, write and execute files, but they can also delete files.

Is there any way in which demoUser would not able to delete files?

0
3

Sticky bit is a permission bit that is set on a file or a directory that lets only the user/owner of the file/directory or the root user delete or rename the file, even when write permissions are given through group ownership.

Sticky bit can be set with:

chmod +t /directoryname

After this, users with write permission should not be able to delete files inside that folder unless they created the file/folder themselves. You can also make all files in that folder inherit group ownership, by using:

chmod g+s /directoryname

I just did a little test to make sure. I created a folder named testfolder, with ownership root:user1. I set 775 permissions (rwxrwxrw) and then ran:

sudo chmod +t testfolder

to give it sticky bit, and:

sudo chmod g+s testfolder

to make new files inherit group ownership.

After that, I logged in with user2, which is group member of user1. I went inside the folder and tried to delete the testfile that had rwx permissions for group user1. Since user2 is a member of that group, they should have permissions to delete it, but they didn't. Permission denied.

After that, I decided to remove the sticky bit, using:

sudo chmod -t testfolder

and then tried to delete the file again. It worked.

Not sure if this is what you are looking for since you don't want users to use touch or mkdir. This would only disallow them deleting stuff while keeping write.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.