Short version: Can you make a symlink read only? I mean the link itself, not the file to which it points.


Long version: I have about 100 users who all have a .login. They like to modify their .login, which is fine in most cases, but sometimes they do it wrong & it screws up a LOT of the things they are supposed to be doing. Because of this, I'm going to lock down all .logins & I thought, "wouldn't it be nice if we could modify one file & all users would get the modification?" So I'm currently testing having everyone's .login point to a central .login via symlink. It works fine, but it appears that the users can [re]move the link & replace it with a file, thus defeating the purpose.
The question, then, is: Can I lock down the symlink so the user cannot move or remove the link? FWIW, it must be a symbolic link (as opposed to a hard link) as the file it points to is on an NFS share (not the same file system).

The permissions of a file control whether the user can modify the contents of it. But whether a user can create, delete, or rename a file depends on the permissions of the directory it's in, not on the permissions of the file itself.

http://en.wikipedia.org/wiki/File_sy...ns#Permissions

It can help to think of a directory as just another kind of file; one that keeps a list of all the other files that are "in" it. Only people who can modify the directory "file" can control what's in that directory.

Trying to change the file permissions of a symlink is pointless, because there are no contents to modify.

What you can do if you want to be ruthless is setup the central .login (or just use /etc/profile) and as part of the login process, have it remove any local-to-user .log/.bash_profile etc before it hands over ctrl to the user.

Sorry for the delay in my response, but thanks for the comments.

I believe I'm going to make the default /etc/csh.chsrc or /etc/bash.bashrc point to the central file that sets up a "company sanctioned" environment & allow the users to go to town on their own ~/.login. This way, we can simply move the user's ~/.login out of the way if they do it wrong.