Re: chattr immutable

2009/2/16 Dermot Paikkos <[email protected]>:
>> Dermot Paikkos wrote:
>> >
>> > mkdir myfolder; chmod 777 myyfolder; chattr +i myfolder
>> >
>> > Then from a windows box tried to delete the folder and got
>> permissions
>> > denied, so far so good. They I tried to copy a file to the folder
> and
>> > was denied also, not so good.
>> >
>> > I have tried a combinations of +i +a but I can't get the desired
>> effect.
>> > Is what I am attempting possible or should I create a new share and
>> use
>> > smb.conf to administer the file permissions?

I'm presuming that your users have write permission on the root of the share, otherwise they wouldn't be able to delete the sub-directory in the first place. If this is the case, you could use the restricted delete attribute (see man chmod) on the parent directory (with world write) and then make the shared non-deletable sub-directory owned by root, with world write. This basically prevents users from deleting files that aren't owned by them, so as long as the sub-directory is owned by root, only root can delete it. This is the way the /tmp directory works. This is how you would need to create your shares (run as root):

mkdir /opt/my_share
chmod 1777 /opt/my_share
mkdir /opt/my_share/sub_share
chmod 1777 /opt/my_share/sub_share

Note that I have also added the restricted deletion bit to the sub_share. If you want to let users delete each others files inside that directory, you can omit the 1 at the beginning (777).

I haven't tested any of this over a samba share, but I don't see why it wouldn't work there too.

Hope I have understood you correctly.

Cheers

Adam

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.4)

iEYEARECAAYFAkmZySoACgkQfNJVASeK9ui4fQCdHre0wefc66qRpzTbnkZLuvcp
qnQAn39Ftb17vOz4u3oIu7M/lHq8JeRx
=v6ke
-----END PGP SIGNATURE-----