1

I am working on a file server project for school and I am using samba to share the folders. I have been playing around with the folder permissions but I can't seem to figure out how to make a drop only like folder. This is what I want to achieve:

  • Owner (server account): Full control (chmod number 7xx)
  • Group (users that sign in to the samba server) : Only place (drop) files,so this means don't open/edit/delete files in the folder (chmod number x?x)
  • others : no access (chmod number xx0)

I have tried a lot of different chmod settings but never achieved the wanted result. Is this even possible? I googled a lot but couldn't really find a concluding answer.

Maybe a way to set permissions on files whenever they are placed in the folder?

If you need more information about the samba configuration or anything else please ask!

Thank you for helping out!

  • Remember, there are permissions for both files and folders. You can make a folder read or write only. Also, a folder is normally executable, but if you don't make it executable, it can't be listed or entered, but files can be read or written to if specified (and if appropriate permissions are set). – Marty Fried Sep 28 '14 at 19:53
  • @MartyFried I figured that out, also it's okay for people to list the items in the folder but not open them. So what permissions do I need to set on the files and folder? Thank you for the reply! – Bram Sep 28 '14 at 19:58
  • 1
    You should edit your question, then. But my guess is you want the files to be rw--w----(620). If they are executable files, then it would be rwx--wx---- (730). – Marty Fried Sep 28 '14 at 20:31
  • 1
    @MartyFried You've explained it mostly backwards. Actually, executable permission on a folder gives the right to access its contents by name (as well as to cd to the folder, as you say). Read permission on a folder enables you to list names of its entries (though not to view even their metadata). See this example and Gilles's answer to Do the parent directory's permissions matter when accessing a subdirectory? – Eliah Kagan Oct 8 '14 at 16:02
  • @EliahKagan: Thanks for pointing that out; too bad I can't edit a comment. TBH, I have little experience with multi-user systems, but I wanted mainly to point in the general direction, which is why I didn't try to enter an actual answer. I was probably in too much of a hurry at the time, and didn't think it through clearly. – Marty Fried Oct 8 '14 at 17:12
1

Try this procedure.

Create shared folder and give right permission:

  mkdir /pathYouWant/share
  chmod 770 /pathYouWant/share

This gives no access to other.

  chmod +t /pathYouWant/share

This mode, according to chmod manual page:

   The  restricted  deletion  flag  or  sticky  bit is a single bit, whose
   interpretation depends on the file type.  For directories, it  prevents
   unprivileged  users  from  removing or renaming a file in the directory
   unless they  own  the  file  or  the  directory

As told by Marty Fried files created in the share folder should have the right permissions and this can be achieved with samba share masks in smb.conf:

  create mask = 440
  directory mask = 550

Windows programs shouldn't try to remove read-only files unless delete readonly option is set to yes.

  delete readonly = no

Also if you want to hide all file in share folder:

  veto files = /*/
  delete veto files = no

According to samba manual these directive:

What happens if the user tries to delete a directory that contains vetoed files? This is where the delete veto files option comes in. If this Boolean option is set to yes, the user can delete both the regular files and the vetoed files in the directory, and the directory itself is removed. If the option is set to no, the user cannot delete the vetoed files, and consequently the directory is not deleted either. From the user's perspective, the directory appears empty, but cannot be removed.

After this configuration, the only problem left is that user can still delete his/her own files even if he/she do not see it (It is unclear to us why).

So we decide to follow the_Seppi suggestion to complete the task and Bram Driesen did a script that changes file ownership to the host pc.

He used incron to fire the script whenever a file is placed in the folder, following this as guide to set it up.

  • I tried this method today but it didn't seem to work. – Bram Oct 2 '14 at 20:39
  • Could you explain what goes wrong? – Lety Oct 2 '14 at 20:40
  • I think I found the problem now. Let me test it real quick – Bram Oct 2 '14 at 20:41
  • 1
    Sorry, I did not realize that you want user not able to remove his own files. Now I see that I did a mistake. Tomorrow I'll try another way, and I'll give you a feedback if I found it. – Lety Oct 2 '14 at 21:00
  • 1
    Let us continue this discussion in chat. – Lety Oct 2 '14 at 21:10
1

Unfortunately, your problem is not solvable so easily. If a user has write permission in a directory, he can also delete files. Even if he wasn't able to delete them, he could still fill a file with zeros, which would be a deletion of data, but not of the filesystem node.


An idea which I once used:

You create a cronjob, which recusively removes the write permission of every file in a directory tree (like every file in /home/guest).

Note that you can't simply use chmod g-w -R /home/guest. This would take the write bit off the directories too, making it impossible to place new files there. So you'd need to iterate over every file and remove it's group write bit.

The interval of the cronjob execution is up to you - back then I set it to 10 minutes. I don't know your environment, so I can't give you a recommendation.

Unfortunately I don't have this script any more, so you'll have to do some bash scripting to get it to work. But seriously, I doubt that this is an efficient method.

  • Hmm looks like a solution but not the ideal solution. But hey, thank you for answering! – Bram Sep 28 '14 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.