Samba Sticky Bit Permissions with Windows

[Methus]

Files are written to and changed daily in this particular share.

I like the idea of placing hard links within a secure directory. I might implement this as a security precaution.

As for snapshot, well... the way the department wants to handle backups is for a weekly full backup to be put in place, and then a daily differential backup after that. At the end of the week, the backups are placed on an external hard drive, and this drive is then taken to the city hall and locked up.

I've been working on a Perl script to make tar.bz2 archives of the necessary files. I'm working on a solution for when the files are locked and cannot be archived, and for differential backups using tar.
It's been a great learning experience so far, I must say.

Thank you for all the help with this.

[redmk2]

Files are written to and changed daily in this particular share.

I like the idea of placing hard links within a secure directory. I might implement this as a security precaution.

As for snapshot, well... the way the department wants to handle backups is for a weekly full backup to be put in place, and then a daily differential backup after that. At the end of the week, the backups are placed on an external hard drive, and this drive is then taken to the city hall and locked up.

I've been working on a Perl script to make tar.bz2 archives of the necessary files. I'm working on a solution for when the files are locked and cannot be archived, and for differential backups using tar.
It's been a great learning experience so far, I must say.

Thank you for all the help with this.

Read up on rsnapshot. It uses hardlinks to make backup copies for hour, day, month year. The whole thing is written in PERL.

Edit: I want you to look at how the hardlinks are created in a script. Not so much for the backup aspects.

[Methus]

Well noted. Thank you again for your help in pointing me in the right direction and guiding my learning in this experience. I have definitely discovered a whole new aspect of Linux I had no idea was there (the deal with inodes in particular).

[redmk2]

Well noted. Thank you again for your help in pointing me in the right direction and guiding my learning in this experience. I have definitely discovered a whole new aspect of Linux I had no idea was there (the deal with inodes in particular).

You're welcome. If you want practical help rather than just the theory on setting up a test share let me know.

[mailmuncher2000]

I know this is an old post but I had similar question which I think I have understood now so I am just putting it out there in case it is helpful to someone else searching for this. Also I don't think Methus' is original question got answer completely so here goes. Please correct me if I am wrong.

Lets say you have a directory called "Docs" permissions as follows (note: no sticky bit)

drwxrwx--- 2 root users 4096 Jul  8 04:47 Docs

And two files inside the directory "Docs" file1 created by alice and file2 created by bob with permission as follows:

-rw-r----- 1 alice alice    5 Jul  8 00:28 file1
-rw-r----- 1 bob bob       9 Jul  7 21:52 file2

In this case bob would be able to delete file1 even though he has only read access to the file (in either owner or group permissions). Actually it is the permissions on the directory that determine if bob can delete the file so in this case bob has write permissions on the directory (because he is in the "users" group).

Now lets say we add a sticky bit to "Docs"

sudo chmod +t Docs

And so now "Docs" permission becomes (with sticky bit):

drwxrwx--T 2 root users 4096 Jul  8 04:47 Docs

Now bob will not be able to delete alice's file1 because of the Sticky bit.... I think this is what you wanted Methus. In this case only the owner (alice) of file1 can delete it.

If you want to implement this with Samba just use "force directory mode = 1000" in the /etc/samba/smb.conf config file for the your share and then every folder you create under that share will have the sticky bit set. See this. More specifically "force directory mode" does a 'OR'ing of permission bits so that every permission number will have 1 in the beginning eg: 0755 OR 1000 = 1755 => folder with sticky bit.

Example smb.conf code:

[Docs]
        writeable = yes
        path = /Docs
        force directory mode = 1000

With regard to Setting the SUID/SGID bits you might wanna check this link out.