Hello All!

I want to restrict users to delete _one_ file from they own home directory.
Is it possible on UFS ?

----------------- cUT here ------------------------
/export/home/User2$ ls -l anyfile
-rwxr-xr-x   1 root     root          53 Aug  2 11:17 anyfile
/export/home/User2$ whoami
User2
/export/home/User2$ rm anyfile
rm: anyfile: override protection 755 (yes/no)?
----------------- cUT here ------------------------

WBR, Andrei.

In article <2n9os4Fug3bcU1@uni-berlin.de>, Pro <Pro@example.net> wrote:

> Hello All!
> 
> I want to restrict users to delete _one_ file from they own home directory.
> Is it possible on UFS ?
> 
> ----------------- cUT here ------------------------
> /export/home/User2$ ls -l anyfile
> -rwxr-xr-x   1 root     root          53 Aug  2 11:17 anyfile
> /export/home/User2$ whoami
> User2
> /export/home/User2$ rm anyfile
> rm: anyfile: override protection 755 (yes/no)?
> ----------------- cUT here ------------------------
> 
> WBR, Andrei.

If they own the directory, they can write to it.  Therefore, they can 
delete files from it.  It's unclear what you want to do from your 
description and example as they seem to contradict each other.  If you 
want to restrict a user from deleting a file that's in their home 
directory, then that user can't be the owner of the file.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...

"Michael Vilain <vilain@spamcop.net>" wrote:
> In article <2n9os4Fug3bcU1@uni-berlin.de>, Pro <Pro@example.net> wrote:
> 
> 
>>Hello All!
>>
>>I want to restrict users to delete _one_ file from they own home directory.
>>Is it possible on UFS ?
>>
>>----------------- cUT here ------------------------
>>/export/home/User2$ ls -l anyfile
>>-rwxr-xr-x   1 root     root          53 Aug  2 11:17 anyfile
>>/export/home/User2$ whoami
>>User2
>>/export/home/User2$ rm anyfile
>>rm: anyfile: override protection 755 (yes/no)?
>>----------------- cUT here ------------------------
>>
>>WBR, Andrei.
> 
> 
> If they own the directory, they can write to it.  Therefore, they can 
> delete files from it.  It's unclear what you want to do from your 
> description and example as they seem to contradict each other.  If you 
> want to restrict a user from deleting a file that's in their home 
> directory, then that user can't be the owner of the file.
I want to restrict user from deleting file from HIS home directory. But 
because user is owner of his home directory he could delete files even 
if the file owner is root.
But may be there is way to restrict file deletion in such conditions?

In article <2nbd7tFt4tuuU1@uni-berlin.de>, Pro <Pro@example.net> wrote:

> "Michael Vilain <vilain@spamcop.net>" wrote:
> > In article <2n9os4Fug3bcU1@uni-berlin.de>, Pro <Pro@example.net> wrote:
> > 
> > 
> >>Hello All!
> >>
> >>I want to restrict users to delete _one_ file from they own home directory.
> >>Is it possible on UFS ?
> >>
> >>----------------- cUT here ------------------------
> >>/export/home/User2$ ls -l anyfile
> >>-rwxr-xr-x   1 root     root          53 Aug  2 11:17 anyfile
> >>/export/home/User2$ whoami
> >>User2
> >>/export/home/User2$ rm anyfile
> >>rm: anyfile: override protection 755 (yes/no)?
> >>----------------- cUT here ------------------------
> >>
> >>WBR, Andrei.
> > 
> > 
> > If they own the directory, they can write to it.  Therefore, they can 
> > delete files from it.  It's unclear what you want to do from your 
> > description and example as they seem to contradict each other.  If you 
> > want to restrict a user from deleting a file that's in their home 
> > directory, then that user can't be the owner of the file.
> I want to restrict user from deleting file from HIS home directory. But 
> because user is owner of his home directory he could delete files even 
> if the file owner is root.
> But may be there is way to restrict file deletion in such conditions?

No, AFAIK, there isn't.  If you take backups, this won't be a problem.  
Any user stupid enough to delete their own directory should have their 
expectations set to limit how much work they've actually lost (e.g. 
what's your backup cycle).

"It's impossible to make something foolproof because fools are so 
ingenious"

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...

Pro <Pro@example.net> wrote in message news:<2n9os4Fug3bcU1@uni-berlin.de>...
> Hello All!
> 
> I want to restrict users to delete _one_ file from they own home directory.
> Is it possible on UFS ?
> 
Hello,

If the user owns the directory I don't know how you could stop the
user from deleting a file within the directory regardless of the
file's ownership and permissions. In fact I think you cannot.

Two possible solutions for your problem:
1) - modify the ownership of the home directory - for example make
root the
     owner
   - make the directory sticky bit (see sticky(5) for details)
   - allow the user full permissions to the home directory - either
through
     the group permissions (maybe with user private group) or with
ACLs
     (see setfacl(1) )
   - create the file in the home directory with a owner different than
the user
 
2) - create a directory owned by root in the user's home directory -
say
     rootdir; give only read/execute permissions on rootdir for the
user
   - create your file in this directory

    In this second variant the file is not directly under the home dir
but
    maybe this isn't so important for you.

I didn't actually test these but think they should work

Vlad Grama.

In article <7f6f1725.0408040356.18de8d54@posting.google.com>,
Vlad Grama <vgrama@gmail.com> wrote:
[...]
>Two possible solutions for your problem:
[...]
>2) - create a directory owned by root in the user's home directory - say
>     rootdir; give only read/execute permissions on rootdir for the user
>   - create your file in this directory

This doesn't stop the user doing

  mv rootdir i_do_not_want_rootdir

As long as the .. link doesn't change, rename(2) does not need access to
the directory being renamed.

Chris Thompson
Email: cet1 [at] cam.ac.uk