ACL problem: want to prevent user(s) deleting files in a given folder

You can try this in Terminal:
sudo chmod +a "everyone deny delete,deletechild,file_inherit,directoryinherit" /Path/to/directory.

If you try and delete the folder or file, an admin password will be required.

Alternatively, if you know the short username of the account, you can replace everyone with that short username.

I'm not sure why, as all that ACL does is deny delete permissions. Run this command in Terminal on the directory you are having issues with:
ls -aled /Path/to/directory

Post the output. Thanks.

Ah yes, the folder is owned by the admin group.

Try changing the owner to the student account and running these commands:

sudo chown student:staff "/Path/to/directory"
sudo chmod -a# 0
sudo chmod +a "student deny delete,deletechild,file_inherit,directoryinherit,chown,writesecurity" /Path/to/directory

(replace student with the short username of the student account).

That should make them the owner, deny deletion of items, keep write access, and change them from altering security settings.

The ACL that was applied specifically denies the ability to delete any objects in the folder but does not grant the permission to write to the folder or child objects. Without an ACL that grants those privileges the POSIX permissions take precedence and deny the 'write' permissions to any user but the owner of the folder.

In Terminal.app do (all on one line, may be wrapped here):

sudo chmod +a "<userorgroup> allow read,write,list,search,addfile,add_subdirectory,readattr,writeattr,readextattr,writeextattr,readsecurity,f ile_inherit,directoryinherit" /path/to/directory

That shouldn't really matter at this point. The above set of commands sets the students as the owner.

@junglejimnz: You can use whichever command you want. Either use the chown above, or replace it with the ACL Mabel provided. You can use either one, as they should both have the same effect. Just clearing up any confusion you may have had. 😉

Ok. I have mobile accounts set up for students... and I have collaborative work areas set up for them - dropbox, handouts, and teamwork folders. I want them to be able to rw to the teamwork folder and was told that I could use acl's to stop them from being able to delete. All looks and acts fine until they access the folder ONE time and then it breaks... they loose all permissions and then are unable to continue.. this occurs with any type of file... nevermind the fun that is Microsoft Office!
I would like really appreciate finding out how to fix this if possible. Right now the group that all students belong to has rw access to the folder and they can delete but I would it would be nice if I could implement the things that apple says I should be able to implement.

the acl's

students belong to a group whose acl has rw
posix
admin is owner
student group has rw
others none

Any help or insight would be much appreciated.
Thanks