Prevent user to overwrite files and directories

Question

Help me to learn if this scenario is doable using Linux. I want to secure the access to a system path called "/mnt/data".

System users retrictions:

• 'daemon_user': read/write access.
• 'read_user': only read.
• 'appender_user': add files but NOT delete or overwrite existing ones.

'daemon_user' constantly creates new files so the "do not delete/overwrite" restriction has to apply for the new files created as well.

Note: Initially I discard to use 'chattr' since that applies to all users, including root. I don't want that level of restriction.

Answer 1

You can implement daemon_user and read_user with POSIX extended ACLs (getfacl, setfacl, chmod, chown). For appender_user you can use append attribute (chattr +a filename, lsattr), but this would limit for all users.

Another way to implement this is to use a service that limits the access to those files. E.g. you share the files with samba and you use Windows ACLs that have append only attribute.

Another way to implement appender_user is to create a SELinux targeted policy. See how httpd_sys_ra_content_t was implemented.