mjhjmtu

I want to give users the ability to create write and read files in other user directory, but not to have option to delete the file after created ( sticky bit not going to work here ... )
for example :

I have user manager with directory repository

I have user worker1 that need to write files to /manager/repository but can't delete the files

I have user worker2 that need to write files to /manager/repository but can't delete the files

I have user worker3 that need to write files to /manager/repository but can't delete the files

but worker 1-2-3 can't delete the files after created only manager and root can delete the files worker 1-2-3 created.

I tried few chown and chmod tricks with applying the sticky bit without success.

First of all make sure ACL is enabled in your system, then run this command

setfacl -d -R -m user::rwx,user:worker1:---,user:worker2:---,user:worker3:--- 
/manager/repository

How it works

• This command will give give read, write and execute permissions for the owner on the directory /manager/repository. It will revoke all permissions for worker1, worker2 and worker3.




• This will give other users, read & write access but will deny the delete access.

From man setfacl:

-d, --default
 All operations apply to the Default ACL.

-R, --recursive
 Apply operations to all files and directories recursively.

-m, --modify
 Options to modify the ACL of a file or directory.

Unlike Windows there is no distinct delete permission under Unix/Linux. The right to delete (or create or rename) a file is bound to the containing directory. Remove the write permission for the workers on /manager/repository/ in order to deny the workers to create, delete, and rename files.

Note that it is not possible to permit creation of files but to deny their deletion.

To do that with permissions, you'd need a system with support for ACLs similar to NFSv4 ACLs. For instance, on FreeBSD, if the filesystem is mounted with the nfsv4acls flag, you can do:

mkdir testdir
chown manager:worker-group testdir
chmod 775 testdir
setfacl -m group@:D::deny testdir

To explicitly deny the delete_child permission to members of the worker-group group.

However note that since the workers would be owners of the files they create, they would still be able to modify the ACLs on them, and by granting themselves the delete permission, that would take precedence over the delete_child permission of the parent directory and I'm not sure there's a way around that (at least on UFS filesystems on FreeBSD). For instance they could do:

$ touch file
$ rm -f file
rm: file: Operation not permitted
$ setfacl -m owner@:d::allow file
$ rm -f file
$

To take write permissions from the /manager/repository folder. So, all the users who are not root will be able to write or delete from the files inside /manager/repository, but not to delete any file from this directory.

chmod 755 /manager/repository