Hello,

I was wondering if there is a way to set up a directory and give a group of users read/write permission to said directory. On the surface this is simple, i.e. setting up a group and setgid of that group on the directory.

But, here is the catch, I want to keep the directory read/write for all users no matter what other users do. For example, bob creates a sub-directory named secret-project and removes the group write permission from secret-project, none of the other users will be able to create files inside of it. So basically, is there a way to prevent users from changing the permission/group-ownership on the files/folders they create?

Thanks!

Set the 'sticky' bit on the parent directory, that's a start. I can't think of any means of preventing a user from tinkering with permissions, unless somehow the owner of the file is always 'root' (or a dummy user). The only other option I can think of is to run a script every hour or so to ensure that permissions are set the way you want.

I was hoping there was an easier way, but alas, I have started on a script that uses the inotifywait to detect new files in the directory tree and set their permissions accordingly. It will also change the owner, like you suggested, to a dummy owner, which will prevent any further permission/group changes.