File and directory Security

[baddou_1]

Hello all

For exemple i have à parent directory /Papa that contain File1.
how can i give a user possibility just to create files in /Papa but not to modify or delete the created files.

thanks a lot

[GGA]

hello
http://nixdoc.net/man-pages/HP-UX/man1/chmod.1.html
regards gga

[Mark Nieuwboer]

You can do this with sudo our a script.
Becuase you must make the fileowner differnt from the user thats created the file.
If you have sude it would be something like this in the sudoers file.
The user must be in the sys group in the example.

Cmnd_Alias CREATEFILE = touch /Pappa/

## bind command to groups
# SYS
SYS ALL = (ROOT)CREATFILE

grtz. Mark

[Steve McClendon_1]

Here's another way:

You must have the directory write capable by the user's group.

The user can create the file, then modify permissions using "chmod" and change ownership and/or group of the file using "chown" or "chgrp" to give away the file. Permissions must be changed prior to owner or group change.

Example:
User ID: baddou
baddou groups: bgroup, users

/Papa would have group of "users" and group write perms set.

baddou creates /Papa/File1.
baddou sets permissions on /Papa/File1 to 770 with "chmod 770 /Papa/File1.
baddou sets ownership of File1 like so: "chown user1:agroup /Papa/File1"

After this is done, user baddou cannot do anything else with /Papa/File1.

However, you need "user1" to be a valid user or use "root". Also "agroup" needs to be a valid group and other users who need to access File1 need to be in the "agroup" group.

I hope this makes sense. The bottom line of the example is that a user is able to "give away" a file by changing ownership to another user. Once this is done, it cannot be undone by the user, only the new owner.

Regards,
Steve