Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On FreeNAS (FreeBSD) ... I'm trying to make a folder 'undeleteable'.

I logged in as root. I created a folder called test and chmod it to 700 (rwx------). Owner is root, group is wheel.

Then I log in as a user called john, which is part of group bbstaff -- and I am able to rename AND delete folder test. Shouldn't that be impossible?

I thought the w permissions prevented renaming.

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

The sledgehammer solution to this sort of problem is to make the directory immutable. This should be done with extreme care, as it's not a very common operation, so if you do it it's a very good idea to leave a file behind in the directory, with a giant warning:

# /some/directory/VAR_HAS_BEEN_MADE_IMMUTABLE.WARNING

Once you've done that:

# chflags schg /some/directory/var

You'll find it no longer can be moved, deleted, or altered, even by root until you've flipped the flag back.

Note that this is the BSD approach to the linux command chattr +i

http://www.cyberciti.biz/tips/howto-write-protect-file-with-immutable-bit.html

share|improve this answer
add comment

Google offers many answers, including ths one, which says "setting the sticky bit on the parent directory will only allow deletion by the directory owner.

chmod +t /some/dir/ParentDir

Look at the usage section on http://en.wikipedia.org/wiki/Sticky_bit for more information about Sticky bits"

This one also advokates using the sticky bit.

Thirdly, this page says "When a directory is made sticky, it adds a special security feature. It prevents someone from deleting or renaming files in a directory unless they own the file.".

Looks like that's your solution.

share|improve this answer
1  
Thanks for the lead ... actually, for FreeBSD, the sticky bit is set using a 1 prefix before the permissions, e.g., chmod 1777 /path/file. But what I want to do is 'lock' a particular directory, not ALL the directories. Is that possible? –  Ze'ev Feb 6 '13 at 1:44
    
+1 I am not sure that I understand "lock' a particular directory, not ALL the directories" - do you mean lock the directory, but not its sub-direcctories e.g lock /home/a but not /home/a/b or /home/a/c etc ? –  Mawg Feb 6 '13 at 1:53
    
Sorry, I wasn't clear. I want john to be able to read/write/rename/delete everything that is in the same folder as test EXCEPT for test. I want him to only SEE test but NOT be able to delete/rename/open it. Same goes for all other users in group bbstaff. –  Ze'ev Feb 6 '13 at 2:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.