0

I'm looking for a way to stop accidental deletion of some important files in Linux, but with a couple of criteria. The file has to remain writable (so it can of course still be replaced with rubbish data, truncated etc.), and the user must be able to create new files in the same directory.

An ideal solution would have newly created files in the directory pick up the same attributes automatically, but I could work around that in software.

The solution is guarding against someone running a misplaced rm command.

2 Answers 2

4

To stop accidental deletion, this could be as easy as creating an alias for "rm" for all users (e.g. by putting this in ``/etc/profile```):

$ alias rm="echo Please don\'t delete any files\!"
$ rm foo
Please don't delete any files! foo

To prevent users from using the /bin/rm command, one could set ACLs to that command, e.g. to allow only users in the "staff: group to use /bin/rm:

$ sudo chmod 0700 /bin/rm
$ sudo setfacl -m g:staff:rx

That won't stop intential removal of files though. If the file needs to be writable, users can just "null" the file (if not prohbited via "chattr -a") - the file will still be there but is of zero size.

Also, users can use /bin/unlink to remove the file (if not prohibited by ACLs, see above) or compile their own version of rm or unlink altogether, thus circumventing all the shenanigans done above.

To really prevent files from being deleted, correct Unix permissions or ACLs would be the way to go.

1

Just saw this has 1000 views but the answer I went with wasn't on here.

The solution was pretty easy, you can take away write permission on the directory itself, leaving it with permissions of dr-xr-x--- in this case.

That stops files being created or deleted in the directory, but leaves you with full access to the files in there. We changed the application to just grant itself write access to the directory whenever it needs to create a file, and then remove the write access just after.

Result is no accidental file deletion with a misplaced rm. It doesn't stop intentional file deletion as you can just chmod the permissions back if you really want to get rid of stuff.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .