Take the 2-minute tour ×

I have a directory shared through Samba. I want users to be able to create/modify/delete files but not create/erase directories. I haven't found a way to do it. Maybe with SELinux? But how?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

The elegant way would be using richacls. But that is not an official part of the kernel yet and thus may be difficult to use for you.

An easy workaround would be to use the samba parameters directory mask and force directory security mode to render newly created directories useless (inaccessible) to the users so that they learn not to create directories.

The funny (and portable!) way would be to create so many (invisible) subdirectories that the file system's subdirectory limit is reached. If a new subdirectory is needed the admin would simply rename one of them.

share|improve this answer
+1 for the portable method –  zje Jun 4 '13 at 15:39
thanks! i will try it! –  acvF Jun 4 '13 at 16:04
... specs changed, some users have to be able to create directories, so i will try to recompile the kernel with richacl –  acvF Jun 5 '13 at 16:13

What you can do is use a FUSE filesystem like bindfs in combination with a LD_PRELOAD hijacker that disables the mkdir and rmdir system calls. Like create a wrapper.c file with:

#include <errno.h>
int mkdir() { errno = EPERM; return -1; }
int rmdir() { errno = EPERM; return -1; }

Compile it with:

gcc -fPIC -shared -o wrapper.so wrapper.c

And run:

LD_PRELOAD=$PWD/wrapper.so bindfs the-dir the-dir

Which will mount the-dir over itself but without the ability of creating a deleting directories.

You'll still be able to rename directories though.

share|improve this answer

On Linux and ext4 file system, a hacky way to prevent directories (and not other types of files) from being created is to rely on the fact that newly created directories inherit the default ACL entries from their parent directory (in addition to the corresponding non-default ACL entries) while files only get assigned the corresponding non-default ACL entries and on ext4 at least, there's only a limited space per inode for storing those ACL entries.

So, if you fill up that space for a directory with default ACL entries up to the brim, you'll still be able to create files in there, but not directories as the system will not be able to create both the default and non-default ACL entries:

$ i=50000; while setfacl -m "d:u:${i}:-" .; do i=$((i + 1)); done
setfacl: .: No space left on device

(the exit condition on that loop is when setfacl fails (here on ENOSPC because no more ACL entries can be added)).

$ getfacl . |  grep -c default:

507 default ACL entries were added (effectively denying access to any file and directory created in there to users 50000 to 50506).

$ touch file
$ mkdir dir
mkdir: cannot create directory ‘dir’: No space left on device
$ ls -l
total 4
-rw-r--r--+ 1 chazelas chazelas 0 Nov 27 13:35 file

Even root cannot create directories in there:

$ sudo mkdir x
mkdir: cannot create directory ‘x’: No space left on device

That doesn't prevent users from removing or renaming directories in there though (if some have been created prior to you adding those default ACLs).

share|improve this answer

Your Answer


