How to lock a file against deletion but still make it writeable?

Question

I want to make a file locked against deletion but still be writeable. How do I do this?

The file in question is a Truecrypt volume as a file on a NAS SMB Network share, so I don't want to accidentally delete it.

Solution 1

For Windows:

1. Deny "Delete" permission on the file.
2. Remove or deny "Delete child items" permission on the parent directory.

For Unix (including OS X):

1. Remove "Write" permission on the parent directory.

Note that this will only prevent the file from being removed (deleted), but won't do anything against accidental truncation or overwriting with garbage. If a file is writable, you can write anything to it, period.

Also, file permissions are next to impossible to translate between operating systems. If the NAS runs Linux, and you try to set permissions from within Windows, the end result may be different from what you expect.

Solution 2

In Linux you could create a hard link to it. Then you can write to it and "delete" it, but you'll be only removing the reference in your directory. The other hard-link will still point to the file's contents, so it won't have been deleted anyway.

In Unix world, you don't "delete" files. You just decrease the number of hard links to it. When nothing else is pointing to it, the space is considered free and can be used…

Solution 3

Backups. You can't really protect a writeable file from damage even if you can from deletion. Back it up daily.

Comments

[soandos]

Its not possible. Writing zeros amounts to deleting it.

[therobyouknow]

@soandos - I don't agree I'm afraid. Because writing zeros to it still means that the file exists, but is full of zeros. Indeed there are Linux commands to create a 'sparse' file full of zeros.

[RBerteig]

+1. Do this no matter what other belts and suspenders are applied.

[Richard]

You don't actually need to Deny delete, just remove Delete from existing access control entries (ACEs). (Deny ACEs make things more complex, usually not a good course in the longer term.)

[CarlF]

Good idea. Don't know if @Rob can create hardlinks on his NAS, but if he can that's a very clever solution.

[therobyouknow]

+1 I'll could that in combo with the accepted answer if possible. or seperately if not. +1 for thinking outside the box as said. However the linux share in question is a NAS drive, not sure what console facilities are available, its an embedded or semi-embedded form of linux. +1 still though as it might help other folks who have a regular linux desktop or computer acting as a share.

[therobyouknow]

+1 CarlF and +1 RBerteig. Totally agree. The files are all backed up onto optical media as well (DVD-R,+R,+R DL and blu-ray 25gb and dl 50gb). I may also consider a second hard drive.

[Rotsor]

The same technique should work with NTFS.

[user1686]

@Richard: AFAIK, removing requires completely disabling ACL inheritance for that file, which makes it even more complex in the end.

[surfasb]

I agree with Grawity. Deny Delete permission is the way to go. If the share permission is set to modify, then the deny will still block the deletion, while leaving it blank will allow deletions.

[therobyouknow]

I should add, I have backups of the files within the truecrypt volume which is the container file. Not the truecrypt volume itself.