Hello Forum,

My question is a little offbeat and I'm unsure where it belongs so I'm hoping this forum is the right place to start.

I'm inquiring about file permissions with regards to a Windows computer accessing files on a Linux File Server. Our scenario is that we have .txt files saved on a Linux file share. The requirement for our users is to be able to rename the files but not change the contents of the .txt files. I know of no way to do this through permissions but I'm not an expert on Linux file permissions so I thought I would throw this question out to this group.

I did do some research on file permission settings:

Linux permissions dictate 3 things you may do with a file, read, write and execute. They are referred to in Linux by a single letter each.

r read - you may view the contents of the file.
w write - you may change the contents of the file.
x execute - you may execute or run the file if it is a program or script.

For every file we define 3 sets of people for whom we may specify permissions.

owner - a single person who owns the file. (typically the person who created the file but ownership may be granted to some one else by certain users)
group - every file belongs to a single group.
others - everyone else who is not in the group or the owner.

It doesn't apper to me to be a way to set the permission on a file to not change the contents BUT allow rename.

Any advice or pointers you can provide on where I can search further for an answer to my users request would be greatly appreciated.

Thank you.

I do not believe you can attain this scenario. You are correct that you need to grant write access for the file to be able to change the name of it.

One needs write permissions in Linux and I bet in Windows too just to change the file name , therefore the ability to open and change whatever is in it too is there.

read only will not allow this in either Windows or Linux -- so this permissions thing is pretty much cross platform is that respect.

the best you could do is only allow a group of people to do this, but still they'd even be able to changes its contents.
You'd have to make a back up of each file and store it where only someone that can be "trusted" can get at them. That way if someone does decided to go in and change its contents you (should) still have an original (copy).

Nothing is really a secret on a Unix/Linux system, if you must keep something private you need to encrypt it, otherwise root or other users could know it.

^ this is actually a good idea, because you could still rename the encrypted file.

another idea:
if each file is in a separate folder, and those folders are in a directory which allows (whoever) to write, then, i think, (whoever) could rename the folder, but still not change the file.

So far as I know, even when one is using ACLs (Access Control Lists), the Linux permissions model does not allow you to control "rename" separately. You must have write access to the file in order to rename it.

The Windows permission-model is not identical to that of Linux (nor of any other file-system that is external [to Windows]), so there might be a "mapping" from one to the other, but it is nevertheless the security-model of the host (in this case, "Linux"), which must in the end prevail.

There are variances, however mostly I've seen encrypted directories showing a file or files which have long names implying that they are encryption reference files or archives, and therefore the true filename is obscured by the encryption. As So while I do know there are options, personally I would not select any option which would encrypt files but still expose the name of those files freely. In fact, my preference would be that you couldn't tell how many files there were, or how much space they occupied.

Not sure how one would go about doing that, maybe via some type of wrapper.. Id probably just scramble the text/name with ROT13 in addition to the encryption, but what you said would be way better.

Actually, you don't need 'w' on the file, you need 'w' on the dir; it involves changing file's metadata which is stored in inode (dir).
HTH

2 members found this post helpful.