ext4 - permission to create/modify a file without 'delete' permission
 

Hallo,
i want to catch a temp file with dynamic name created by a program that is available only for some milliseconds. For this i probably need some permissions like this: Create/modify but no delete.

I can do this with NTFS but on ext4 it seems impossible. Chattr +i +u or setting folder to sticky seems useless. Setting folder to read-only probably works only if the file would already exist (allows 'modification' and 'no deletion' but unfortunately no 'creation').

Any suggestions?

If you mean "catch" as in "log" then you could use the audit service or FUSE LoggedFS or inotify(wait)?

No, that unfortunately doesn't help. Its a binary file and i'm trying to get it before it gets deleted.

If this is a file that the program creates and immediately deletes while keeping the file open for its own use, you can still access the file via the /proc/{PID}/fd/{FD#} link.

That works indeed. :D
What a valuable tip.. Thank you! :)