I would like to prevent a user (identified by uid) from creating and deleting files in /tmp, but allow this user to create files in directory /tmp/hello, which is owned by this user. How can I achieve that? Only this user should be prevented from creating and deleting files in /tmp, other users whoever have the appropiate permission shouldn't be prevented. /tmp is owned by root.
1 Answer
You can do this using file ACLs.
You prevent the user badguy from creating files in tmp with:
setfacl -m u:badguy:r-x /tmp
And you can allow it to write to the hello directory “normally” (allow everyone, chown the directory to badguy) or, again, with file ACLS:
setfacl -m u:badguy:rwx /tmp/hello
/tmpis usually a quite special directory in that everyone is allowed to create files and directories in it. Is there a particular reason you'd want to disallow this user from creating files under/tmp? Does it have to do with the location of temporary files? If so, does the software that you use honour theTMPDIRenvironment variable (you would use it to specify another directory to create temporary files in). In short, what is the underlying problem that you are trying to solve?/tmp/hello, and I want to make sure this program can only create files in the same directory of the program.