Approaches to prevent user from deleting home folder

Question

I think prevent home folder from deleting is a very good idea. So I search possible approaches to do that. I that's what I’m find:

1. Use chattr +i /home/user - even root can't can add/delete/rename user folder and all direct children in user - good and bad.

2. Change owner of user directory to root and set sticky bit. Add file .keep and change his owner to root too:

   chown root:user /home/user
   chmod 1775 /home/user
   chown root /home/user/.keep 
   

   root can delete /home/user, user can't. But user can freely add/remove/rename files in his directory

3. Use chattr +a /home/user - same as first approach but user can add files.

I think chattr +a on home directory: chattr +a /home is the best way:

1. We can create new home folders for other users without pain.
2. We can freely edit files in /home/user
3. We can't accidentally sudo rm -rf /home/user

Actually the question: what are the pitfalls of this approach?

Answer 1

To remove a directory, you need write permission over its parent. Which means that as long as user can't write to /home, he won't be able to remove his own directory.

$ chown root:root /home
$ chmod 0755 /home

$ chown user:user /home/user
$ chmod 0750 /home/user

With these permissions, root is the only user who can manipulate directories immediately under /home. This setup is actually very common on Linux systems, since they are multiuser ; however, I have seen Ubuntu setups in which /home belonged to the first user (usually ID 1000). While Ubuntu's first user usually is a sudoer (meaning he could delete everything using sudo), I don't think it is a good practise to give /home to anyone but root.

When it comes to chattr, I believe this would be overkill. You are facing a permissions problem, there is no need for other file attributes.