I would like to impose WORM(Write Once Read Many Times) behavior to files and folders of NTFS drive with ntfs-3g.
I am using ntfs-3g latest stable version in my system.

To set this property to the concerned files/folders two attributes may be mutated Create Files/Write Data and Create Folders/Append Data ( Ref http://support.microsoft.com/kb/277867)
Somebody please let me know which attributes should I need to consider acl or something else.

ACL is giving this string to me
system.ntfs_acl=0x0100149ca4000000c4000000140000003000000002001c
000100000002c0140016010d00010100000000000100000000020074000400
000000002800ff011f00010600000000000550000000b589fb381984c2cb5c6c
236d5700776ec002648700001800a900120001020000000000052000000020
02000000001400a900120001010000000000051200000000001800a9001200
01020000000000052000000021020000010600000000000550000000b589fb
381984c2cb5c6c236d5700776ec0026487010600000000000550000000b589
fb381984c2cb5c6c236d5700776ec0026487

Hi,


On ntfs-3g these flags are mapped to the 'w' flags in the mode (so, with a difference as Unix/Linux do not make a distinction between write and append, or between create file and create folder).
Of course this is only meaningful if you map Windows users (those designated in the file) to Linux users.

If you enforce protections, you can set them to 0444/0555 to prevent writing/creating files. This will remove the mentioned flags in the ntfs acls. However on Linux, root ignores the protections and can overwrite/delete any file.

This ACL designates an unusual owner and group, moreover owner is same as group. It has a system audit flag set on writes. In what environment was this file created ?

Currently this owner and group are not recognized by ntfs-3g, so they will appear as root, and changing the protections will force root owner, which you may not want.

You may try to clear the ACL write flags in the environment where you created the file. You have also to clear a third flag "GENERIC_WRITE".... and enforce protections on Linux.

Regards

Jean-Pierre