inotifywait -mrq -e CREATE --format %w%f /DATASTORE/DATA/BACKUP | while IFS= read -r FILE; do chmod 770 "$FILE"; done &

inotifywait -mrq -e CLOSE_WRITE --format %w%f /DATASTORE/DATA/BACKUP | while IFS= read -r FILE; do chmod 440 "$FILE"; done &

#! /bin/bash
# version 0.1
# Limitation:-
# 1) Only works for one file at the moment 
# 2) When * (or *.xxx, xxx.* etc.) is supplied, first file seen is used
# 3) Currently does not filter options (not sure if this will be needed or can be omitted)

# This is the directory where rm command is not allowed
CTRL_DIR="/DATASTORE/DATA/BACKUP"

FILE_DIR=`dirname $(readlink -f $1)`    # This need to be updated once multiple file
                                        # handling is done
echo "Parameters = $@"
echo "The file $1 resides in $FILE_DIR"

if [ $FILE_DIR == $CTRL_DIR ]; then
  echo "You are NOT allowed to issue removal commands in $FILE_DIR;
  echo "This incident will be reported";
  echo "`date +%b' '%d' '%T` localhost `id -un` attempted to execute rm command in $FILE_DIR at `date`" >> /var/log/secure;
  exit 1;
fi

/bin/rm $@

#! /bin/bash
# #########################################################################
# Filename	: rm                                                      #
# Version	: 0.2                                                     #
#                                                                         #
# Description                                                             #
# ===========                                                             #
# This script, when invoked, will supercede the rm command. It will block #
# the rm command execution unless the file(s) reside in the specified     #
# allowed directory i.e. ALLOWED_DIR.                                     #
#                                                                         #
# Known Issue                                                             #
# ===========                                                             #
# 1. If recursive option is specified AFTER a folder argument, the        #
#    contents of the folder will NOT be removed.                          #
#    e.g. rm.sh <folder-name> -r                                          #
# 2. The logging to /var/log/secure does not work due to permission.      # 
#    Changing permission to allow write for non-root users is not         # 
#    advisable as the logs can be tampered with. Pending resolution.      # 
#                                                                         #
# Changelog                                                               #
# =========                                                               #
# Ver   Date (DDMMYYYY) Author  Remarks                                   #
# ---   --------------- ------  ----------------------------------------- #
# 0.1   09122010        Yusoff  Created base script                       #
# 0.2   09122010        Yusoff  Added rm option support for -r, -f and -v #
#                               Enhance initial design                    #
# ----------------------- END - OF - CHANGELOG -------------------------- #
# #########################################################################

# -----------------------------------------------------------------
# Start of script

if [ "$#" -lt 1 ] # No arguments supplied
then
        printf "Usage: rm [OPTION]... FILE...\n"
        printf "Remove (unlink) the FILE(s).\n\n"
        printf "  -f, --force           ignore nonexistent files, never prompt\n"
	printf "  -r, -R, --recursive   remove directories and their contents recursively\n"
	printf "  -v, --verbose         explain what is being done\n"
        exit 2
fi

# -----------------------------------------------------------------
# This is the directory where rm command is allowed
ALLOWED_DIR="/DATASTORE/DATA/ACTIVE"
OPTION_STR=

# Extract the non-option arguments, which would be the file(s) or folder
for arg in "$@"
do
        if [[ $arg =~ '\-[fvr]' ]]
	then
		# do nothing
		OPTION_STR=$OPTION_STR$arg" ";
	else
		# Perform removal if allowed
		FILE_DIR=`dirname $(/usr/bin/sudo readlink -f $arg)`;

		if [ $FILE_DIR == $ALLOWED_DIR ]; then
			/bin/rm $OPTION_STR $arg;
		else
			# If we got here, it means the command was issued where it is not
			# allowed to run by the user
			echo "You are NOT allowed to issue removal commands in $FILE_DIR!";
			echo "This incident will be logged.";
			echo "`date +%b' '%d' '%T` localhost `id -un` attempted to execute rm command in $FILE_DIR at `date`" >> /var/log/secure;
		fi
	fi
done

# End of script
# -----------------------------------------------------------------