Fedora Linux

Making Files Immutable

Because the root user can override permissions, file permissions alone are not enough to ensure that a file will not be changed. But when a file is made immutable, it cannot be changed by anyone.

How Do I Do That?

To make a file immutable, use the chattr (change attribute) command to add the i attribute to the file:

# chattr +i 
               
                  foo
               
# date >>
               
                  foo
               
               
                  bash: foo: Permission denied
               
# mv 
               
                  foo baz
               
mv: cannot move \Qfoo' to \Qbaz': Operation not permitted
# rm 
               
                  foo
               
rm: cannot remove \Qfoo': Operation not permitted

You can find out if the i attribute has been set by using the lsattr (list-attribute) command:

# lsattr 
               
                  foo
               
----i-------- foo

The presence of the i in the output indicates that the file foo has been made immutable.

Removing the i attribute causes the file to act normally again:

# chattr -i 
               
                  foo
               
#
                   
               
               date
               
                   >>foo
               
#
                   
               
               mv
               
                   foo baz
               
#
                   
               
               rm
               
                   baz
               
# ls baz
ls: baz: No such file or directory

How Does It Work?

The immutable capability is provided by the ext2/ext3 filesystems. Each file has an immutable flag that is part of the ext2/ext3 file attributes; when set, the ext2/ext3 code in the kernel will refuse to change the ownership, group, name, or permissions of the file, and will not permit writing, appending, or truncation of the file.

By making configuration files and programs immutable, you can provide a small measure of protection against change. This can be used to guard against accidental changes to configuration files. It can also prevent a program ...