But yes, the directory would be the appropriate place to restrict if you
absolutely wanted to deny rights to delete the file.
You can not deny rights to delete only one file in a directory. You can only deny the rights to change anything in a directory (wiith it’s w-bits and those are in the directory above the directory we talk about) and that includes creating new files, deleting any of it’s files (and not just a particular one), changing acess bits, owner, group of existing files, changing time stamps, in short changing anything that describes the files that are in that directory and all at the same time according to the w-bits of this directory (which are, I repeat, in the directory above this one).
henk@boven:~/test> l blob
total 8
dr-x------ 2 henk wij 4096 Jun 11 22:10 ./
drwxr-xr-x 3 henk wij 4096 Jun 11 22:13 ../
---------- 1 henk wij 0 Jun 11 22:09 mine
---------- 1 marian wij 0 Jun 11 22:09 notmine
henk@boven:~/test>
In the listing above we see that user henk, which is running this, is owner of ./ (which is blob) and …/ (which is test). He may write to test, but he may not write to blob.
We see also that inside blob are mine and notmine. henk is the owner of mine and marian (my wife, nice to meet you) is owner of *notmine. *Nobody can read/write/execute these files.
henk@boven:~/test> rm blob/*
rm: remove write-protected regular empty file `blob/mine'? y
rm: cannot remove `blob/mine': Permission denied
rm: remove write-protected regular empty file `blob/notmine'? y
rm: cannot remove `blob/notmine': Permission denied
henk@boven:~/test>
Now henk tries to delete all files in *blob. *The rm tool warns because it thinks henk may be dumb in wanting to delete a file that is write protected for him. This is not because it thinks it can do it, but because it is cautious. henk is stubborn and says y. Now we see that rm can not do it because henk has no write access to blob.
henk@boven:~/test> chmod u+w blob
henk@boven:~/test> l blob
total 8
drwx------ 2 henk wij 4096 Jun 11 22:10 ./
drwxr-xr-x 3 henk wij 4096 Jun 11 22:13 ../
---------- 1 henk wij 0 Jun 11 22:09 mine
---------- 1 marian wij 0 Jun 11 22:09 notmine
henk@boven:~/test>
Next step, henk makes blob writable for the owner (which is henk). See the owner w bit for ./
He is allowed to do this because …/ (test) is write enabled for the owner henk.
henk@boven:~/test> rm blob/*
rm: remove write-protected regular empty file `blob/mine'? y
rm: remove write-protected regular empty file `blob/notmine'? y
henk@boven:~/test> l blob
total 8
drwx------ 2 henk wij 4096 Jun 11 22:27 ./
drwxr-xr-x 3 henk wij 4096 Jun 11 22:13 ../
henk@boven:~/test>
Now henk repeates his delete and rm again thinks he may be stupid (computers never learn anything). Now mine and notmine are gone, not because any write access to those files is given, but because henk has write access to blob.
To get rid of those warnings one could use *rm -f *instead of rm. Plaese try this.
HTH
