Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #230382 > unrolled thread

Is this possible with DAC or ACL?

Back to article view | Back to linux.debian.user

Contents

  Is this possible with DAC or ACL? Yvan Masson <yvan@masson-informatique.fr> - 2021-01-06 16:40 +0100
    Re: Is this possible with DAC or ACL? Reco <recoverym4n@enotuniq.net> - 2021-01-06 16:40 +0100
    Re: Is this possible with DAC or ACL? David Wright <deblis@lionunicorn.co.uk> - 2021-01-06 17:30 +0100
    Re: Is this possible with DAC or ACL? Greg Wooledge <wooledg@eeg.ccf.org> - 2021-01-06 19:40 +0100
      Re: Is this possible with DAC or ACL? Yvan Masson <yvan@masson-informatique.fr> - 2021-01-07 13:00 +0100

#230382 — Is this possible with DAC or ACL?

Hi list,

Let's say I have a directory `/dir`. Is it possible to allow a user to 
do whatever he wants inside this directory, but not to delete `/dir`?

I can use Unix ACL if needed.

Regards,
Yvan

[toc] | [next] | [standalone]

#230383

	Hi.

On Wed, Jan 06, 2021 at 04:32:02PM +0100, Yvan Masson wrote:
> Let's say I have a directory `/dir`. Is it possible to allow a user to
> do whatever he wants inside this directory, but not to delete `/dir`?

To delete a directory a user must have an appropriate permissions to a
higher-level directory.

Taking your example literally:

root@x:/# mkdir /dir
root@x:/# chown user /dir
root@x:/# su - user
user@x:~$ rmdir /dir
rmdir: failed to remove '/dir': Permission denied

Why it behaves so? Because this:

# ls -lad /
drwxr-xr-x 23 root root 4096 Jan  6 15:33 /

Reco

[toc] | [prev] | [next] | [standalone]

#230384

On Wed 06 Jan 2021 at 16:32:02 (+0100), Yvan Masson wrote:
> Hi list,
> 
> Let's say I have a directory `/dir`. Is it possible to allow a user to
> do whatever he wants inside this directory, but not to delete `/dir`?
> 
> I can use Unix ACL if needed.

Take a look at your own home directory, which behaves more or less as
you described. (IIRC Debian might set group ID on home directories.)

I set up pseudo-home directories like this, eg music, pictures etc,
and I place them under /home, rather than /, so that they reside in
my encrypted /home partition. They're all chown'd to belong to me.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#230389

On Wed, Jan 06, 2021 at 04:32:02PM +0100, Yvan Masson wrote:
> Let's say I have a directory `/dir`. Is it possible to allow a user to do
> whatever he wants inside this directory, but not to delete `/dir`?

Yes.  Simply change the owner of /dir to theuser, but make sure the
parent of /dir (which is / or root because of course you did not give
a POOR EXAMPLE which has a different number of slashes than the actual
directory!!) is owned by root, and isn't writable by "group" or "other".

Since / should already be owned by root, there's nothing required
there, but you can verify its ownership and permissions with ls -ld /

[toc] | [prev] | [next] | [standalone]

#230408

Thanks all for your detailed answers! Sometimes I miss simple things :-)

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web