Can we prevent graphics directories on linux system from being renamed or moved by users?

Question

We (JAMA Network for the American Medical Association) run XPP on Linux. We have a graphics directory for each journal (eg, CAR_OLF_unscheduled for JAMA Cardiology, DER_OLF_unscheduled for JAMA Dermatology) that graphic artists drop eps files into. At least 20 people have access to these directories and more than half of them use them daily. 
 Every so often, someone finger fumbles and accidentally moves or renames a directory. Production stops, panic ensues, and managers hyperventilate because the graphics for some or all current jobs are MIA. We have always been able to find the directories and get them back into place within 1/2 hour but we would like to prevent this. Today a MacUser accidentally renamed the parent directory and all images were NF but this has happened before on Windows using Samba. 
 Does anyone know how to restrict users from moving or renaming these directories while still allowing write access? These are the permissions: drwxrwxrwx 2 jmize wheel 94208 Mar 14 19:34 CAR_OLF_unscheduled

Jonathan Dagresta · Answer

You might try one of these options: 
 
 If the problematic graphic artists' login accounts belong to a different "group", then set the permissions on the parent folders of the image folders to drwxrwxr-x (while the permissions on the image folder themselves will still be drwxrwxrwx). This gives write permission on the parent folders only to the "owner" and "group" of those folders. 
 If everyone's login accounts belong to the same ("wheel") group, then set the permissions on the parent folders of the image folders to drwxr-xr-x (image folders themselves stay as drwxrwxrwx). This gives write permission on the parent folders only to the "owner" of those folders. 
 If you don't trust yourself (or trust the "owner" of the parent folder) then set the permissions on the parent folders to dr-xr-xr-x. This gives no one (except 'root') write permissions on the parent folders. If you have to go this route, then when you do want to add or rename an image folder you will either have to login as root, or su root, or sudo root or you'll first need to (temporarily) add write permissions back onto the parent folder while you manipulate the image folders within it. 
 
 Depending on how bad is the behavior of your graphic artists, you might need to set the restricted permissions on all of the parent folders of your image directories up to the root (/) folder.

XPP > XPP

Can we prevent graphics directories on linux system from being renamed or moved by users?

Top Replies