Linux – How to prevent file owner from changing/deleting their own file? Linux CentOS

access-control-listcentoslinuxpermissions

This is NOT your standard "how do permissions work" question!

I'm thinking the answer will probably involve ACL, but I don't know how exactly.

I've messed around with standard permissions, guid, sticky bit, etc. Doesn't work.

What I want:
User will upload files. User will have ability to change permissions on files to allow execution. But user will not be able to change the contents of file once it's created. And user will not be able to delete the file.

Please help! I've been tearing my hair out for hours!

EDIT:

Thanks for the answers but so far they don't seem to address how to have this work automatically for newly-created files.

Possible solution:

find -mtime -1 -exec chattr +i '{}' \+

2nd possible solution:

inotifywait -m -e create --format %f .

Now I just need to figure out to pipe that to chattr.

Best Answer

You can try to use 'chattr'

Example:

urug@nada.cclan:~$ sudo chattr +i plik.txt 
urug@nada.cclan:~$ rm plik.txt 
rm: remove write-protected regular empty file `plik.txt'? y
rm: cannot remove `plik.txt': Operation not permitted
urug@nada.cclan:~$ chattr -i plik.txt 
chattr: Operation not permitted while setting flags on plik.txt
Related Topic