2

I'm trying to give every user writing permission to the data partition. However when I do so every user can delete each others folder although he has no rights to that folder. What I want is: 1) Every user can write on "/media/data" 2) No user can delete a folder created by another user on "/media/data"

The data partition is mounted via this entry in the /etc/fstab

/dev/sdb1   /media/data    ext4    defaults    0   0

When the partition was empty I also did this:

$ sudo chown -R :users /media/data 
$ sudo chmod -R g+rw /media/data 

As I recall, without these two last commands non of the users could write anything to the data partition.

Now I think the problem is that giving writing permission to the group "users" (g+rw), is part of the problem. Since that already means that everyone in "users" can delete anything under "/media/data". Still I want my multiuser Ubuntu System to be configured in the way as mentioned above (Everyone can write to the data partition, but nobody can delete stuff created by other users).

Has anyone an idea how to do this?

1

The answer to this is to set the sticky bit (t) of your directories.

You set the sticky bit recursively on your data directory by:

sudo chmod -R +t /media/data

This restricts the right to delete or rename a file only to the owner of a file, although the directory might be publicly readable and writeable.

The permissions string will after that look like e.g. rwxrwxrwt if the owner user, group and every other user all have full permissions (read, write, execute), whereas only each specific file's owner may delete or rename it.

  • chmod -R +t could take a while since meanwhile the partition is quite full with data. Or can I unmount the partition then apply it and remount it again? Is working with the sticky bit the 'normal' way to do this? It sounds more like a hack. Or is the only alternative something like 'creating a separate folder for every user on the /media/data partition and manually assigning it to the respective user'? (This should be a common problem on multiuser systems... – mcExchange Aug 15 '15 at 14:25
  • I don't think it will take long, but I have nothing to try it on. However, it's not a hack, but The Right Way™. This is the common practice. It's even used in your default system installation, e.g. for the /tmp directory. Everybody has full read/write/execute privileges, but you may only delete and rename those files you own ( = have created) yourself. Check it with ll -d /tmp. – Byte Commander Aug 16 '15 at 13:47
  • Did it take long as you assumed? – Byte Commander Aug 18 '15 at 12:01
  • It took a while, though I didn't stop the time. (I had some 1TB of data, mostly small files). Still thanks. The question is whether I will do it the same way on the other computers i have to administrate. In the end I always want the behaviour that every user can use the data partition but cannot interfere with anothers data. – mcExchange Aug 18 '15 at 16:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.