Is it possible on samba to have only write access, but no read access and no browsing rights?

I'm trying to solve the this access problem:

A windows XP or windows7 machine running within a VM is connected to a samba share.

This machine has to write a text file to a shared directory.

(It is acceptable for the machine to write the file locally and later copy this file to the network.)

The machine may not have rights to read any other files in the shared directory.

It has to give up access to the file it is writing/copying once the file saved fully.

How do I achive this?

  • I think it would be a problem as most OS's browse the directory before writing to it (to check if the file already exists). So with what command are you going to write to the share? (xcopy is already out of the question in this case). Maybe with something like rsync it could work. (but that's not Samba) – Rik Sep 17 '13 at 8:52
  • you can do this with all samba as mvp explains, but it does sound like a service layer of some kind would be useful. rsynch or even a custom scp script would be options to consider. – Frank Thomas Sep 17 '13 at 11:55

TL;DR: Yes, it is possible. On Linux side, give your parent directory permission 300.

Longer explanation:

Note that for files, typical rwx triplet means permission to r = read, w = write and x = execute.

But for directories, such permissions have different meaning: r = browse directory, w = create or delete files, x = descend to directory or below it to access files or directories.

In other words, if you create directory without r permission, then user will not be able to browse it, however he will be able to access files or directories under that directory provided that filename is known beforehand (access means read or write files according to permissions assigned to files themselves).

Keep in mind that Linux permissions work on level lower than Samba permissions, and even if you edit your smb.conf to give apparently wider permissions, Linux level permissions will win if they are stricter than Samba permissions.

For example, this scheme allows to create directory that allows to create files and write to them, but not be able to browse list of those files or read from them:

mkdir dir
chmod 300 dir         # 300 = -wx------

Note that this directory must be created on Linux side - Windows client may not be able to create it with appropriate permissions.

  • 1
    thanks. We will try this here and come back in a few days if it works... – 576i Sep 17 '13 at 12:35
  • Windows somehow doesn't like it. I cannot save files in above created "dir", even though I used "\\server\full\path\to\dir\file.txt" in filename box of e.g. notepad.exe (right after adding "+r" to dir's mode with chmod, saving worked again) - too bad. – Master of Celebration Nov 27 '13 at 13:20
  • I just checked that Windows cannot change to dir directly, but it can open file inside that dir if specified by name: dir/file.txt. Also, if you create dir/subdir, where subdir has normal permissions like 755, Windows also can change to dir/subdir just fine. – mvp Nov 27 '13 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.