Re: Re: Directory permissions

On 11 April 2017 at 14:32, Kevin Philp <[email protected]> wrote:
> From http://www.thegeekstuff.com/2013/02/sticky-bit/
>
> A Sticky bit is a permission bit that is set on a file or a directory that
> lets only the owner of the file/directory or the root user to delete or
> rename the file. No other user is given privileges to delete the file
> created by some other user.
>
> It sounds what I need but if I think the problem is all the users are split
> into groups and the directory in question has the same group membership. So
> - I may be wrong here - but it looks like if I am in the group I can delete
> the directory - and that is what happened.

There's a bit at the bottom of the document you reffering to:
"Different OS behave differently with sticky bits as explained in this
wikipedia article. For example, Linux only looks for sticky bit if a
user tries to rename a file. It will not check the sticky bit if a
file is being deleted."

So sticky bit won't help, not on a Linux box. But you did not specify
what is your underlying FS? If I remember correctly ZFS has a much
more granular permission system for files. If it is not ZFS and it is
impossible to migrate to ZFS then I'd say SELinux or Apparmor (and I'm
not even sure about Apparmor to be honest) is your only solution. If
your server is CentOS or RedHat then SELinux is already there, all you
need to figure out is mapping of contexts.

Even more hacky way of doing it might be the bunch of "inotify"
processes that monitor your directories for changes, but again I'm not
sure you can cancel a delete request that way (at least you'll get
notified that someone deleted a directory before users confess to
doing it).

Cheers,

Misha

-- 
Irish Linux Users Group
--- 
You received this message because you are subscribed to the Google Groups "ILUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send an email to [email protected].
Visit this group at https://groups.google.com/a/linux.ie/group/ilug/.
To view this discussion on the web, visit https://groups.google.com/a/linux.ie/d/msgid/ilug/CAJ4iq3QRxLiNPHmVE88Huov7FnRC%2BAmxA514WzcnUAnZVH1D3g%40mail.gmail.com.