How can I make a write-only view of a folder?

I asked this same question for student drop boxes on the samba mailing list a few years back (http://lists.samba.org/archive/samba/2008-September/143610.html) and the answer has worked for us. You need extended acl attributes on your filesystem (from the acl package), here's Jeremy Allison's answer...

Ok, the problem is that students need to be able to read the containing directory in order to be able to drag and drop new files there. The reason is that Samba needs to be able to scan the directory on their behalf in order to do case insensitive lookups.

But so long as you don't mind allowing the students to see the names of each others files, you can set up a DropBox so that students can write into it (and their own files) but not edit or see others files.

Firstly, you want to make sure that files created in the DropBox directory are not owned by the student's primary group, but by the group owner of the DropBox direcotry. So :

chgrp teachers DropBox

to make it owned by the teachers group. Then set the setgid bit on the DropBox directory to make sure that files created within there have an owning group of teachers.

chmod g+s DropBox

Then ensure that a file in DropBox can be renamed or deleted by only the owner of the file, or by the owner of the directory, or by root (same permissions that /tmp has).

chmod +t DropBox

Then allow students to write into the directory by adding an ACL

setfacl -m g:students:rwx DropBox

So long as the defaul acl is set so that "others" have no permissions, files written by a student into that directory will be owned by themselves but will have an owning group of "teachers", and students will not be able to read each others files.

If you need to be cause the files to be owned by the owner of the directory, not by the students who created them you need to set up a separate share as described above, but then add the share level parameter :

inherit owner = yes

which will cause files created within the directories in that share to be owned by the containing directory, not the creating owner.

You can achieve some of this by setting the permissions on the folder such that the target users have write access to the folder but not read access.

For example, to allow anyone to write to a folder but not list its contents, you could do the following:

chmod o=wx folder

Or to only give a particular group of users this access:

chgrp groupname folder
chmod o=,g=wx folder

Now those users will not be able to list the contents of the folder but will be able to place files in the folder:

$ ls folder
ls: cannot open directory folder: Permission denied
$ touch folder/filename

This doesn't do everything you want, since if users can still access files in the folder if they can guess the name. You could minimise this risk through a cron job that regularly moved files out of the drop box folder to a location that other users have no access to.

You can create a drop folder "write-only-view" with rw access and use cronjob or inode notification to move the content to the other "read-write-view".

I believe you could simply use bind mount trickery, in /etc/fstab:

/path/to/read-write-view /path/to/write-only-view none bind 0 0

So, you could probably then:

chmod a=wx /path/to/write-only-view
chmod a=rwx /path/to/read-write-view