Approaches to prevent user from deleting home folder

homexattr

I think prevent home folder from deleting is a very good idea. So I search possible approaches to do that. I that's what I’m find:

  1. Use chattr +i /home/user – even root can't can add/delete/rename user folder and all direct children in user – good and bad.

  2. Change owner of user directory to root and set sticky bit. Add file .keep and change his owner to root too: 

    chown root:user /home/user
chmod 1775 /home/user
chown root /home/user/.keep

    root can delete /home/user, user can't. But user can freely add/remove/rename files in his directory

  3. Use chattr +a /home/user – same as first approach but user can add files.

I think chattr +a on home directory: chattr +a /home is the best way:

  1. We can create new home folders for other users without pain.
  2. We can freely edit files in /home/user
  3. We can't accidentally sudo rm -rf /home/user

Actually the question: what are the pitfalls of this approach?

Best Answer

To remove a directory, you need write permission over its parent. Which means that as long as user can't write to /home, he won't be able to remove his own directory.

$ chown root:root /home
$ chmod 0755 /home

$ chown user:user /home/user
$ chmod 0750 /home/user

With these permissions, root is the only user who can manipulate directories immediately under /home. This setup is actually very common on Linux systems, since they are multiuser ; however, I have seen Ubuntu setups in which /home belonged to the first user (usually ID 1000). While Ubuntu's first user usually is a sudoer (meaning he could delete everything using sudo), I don't think it is a good practise to give /home to anyone but root.

When it comes to chattr, I believe this would be overkill. You are facing a permissions problem, there is no need for other file attributes.

Related Question