在Linux上仅创建文件权限

Question

I would like to create a directory under linux (or mount one eg: nfs), where:

1. every user can create files
2. but only the root user can modify the created files (overwrite, delete, or move them)

How can this be done, and how secure are these solutions? (for example: sentinel script, umask, etc.?)

Thanks, krisy

Answer 1

If it is also ok that the user that created the file can change them, you can use the sticky bit. This is the first digit if you give chmod a 4 digit argument.

su - 
mkdir stickydir
chmod 1775 stickydir
chown user.group stickydir

Now all members of group can write to the dir, but only the user that created a file or root can change the files

su - user1 #member of group
touch stickydir/stickytest-user1 #ok
su - user2 #member of group
touch stickydir/stickytest-user2 #ok
rm stickydir/stickytest-user1 #permission denied
rm stickydir/stickytest-user2 #ok

Answer 2

I would try to change file permissions after creation using inotifywait . This (untested) snippet might help a bit, but is definitely not very elegant. It sets root as the owner of all created files in /path/to/dir and removes write-permission for group and others.

while true; \
    do inotifywait -e create /path/to/dir/ && \
    chown root /path/to/dir/* && \
    chmod g-wo-w /path/to/dir/*; \
done

Hope that helped a bit *jost