Linux file permissions provide a basic level of security and access control. Apart from these permissions, 1
Linux also has advanced access control features like ACLs (Access Control Lists) and attributes. 2
The attributes define the properties of the files. They depend on the support of the underlying 3
file system, such as Ext4 , where the attribute data must be stored along with other control structures. 4
Each file attribute can have one of the two states: set and cleared. 5
The attributes are considered distinct from other metadata, such as file system permissions, owner, 6
group, timestamps, size and so on. 7
The ls command does not display the file attributes. 8
I'm not seeing the files attributes; to list the attributes of the files and the subdirectories of the 9
current directory run 10
lsattr. 11
I've got this permission denied error, because probably this file is owned by root. 12
No, it's owned by the current user, but it has no permissions on it. 13
I'm simply removing the file. 14
I'm executing list attributes 15
again. We see many hyphens and the i letter. 16
Each letter you see indicates an attribute which is set and 17
a hyphen indicates that the attribute is cleared. 18
For example, E means extend format and it indicates that the file is using extents for mapping the 19
blocks on disk. 20
In addition to 'e', there can be several other letters in the output. Let's the main page of 21
chattr 22
So man chattr 23
To set an attribute, use the plus sign, which causes the selected attribute to be added to the 24
existing ones; and the minus sign, causes the attribute to be removed. 25
Also note that most of the attributes can be set or cleared only by root. 26
Let's take a look at the most useful ones. 27
You see a list with all of them in this paragraph. A file with the 'a' attribute set that can only be opened 28
in append mode for writing; appending means, ending to the end of the file, only the supervisor 29
possesses the capability to set or clear this attribute. 30
So sudo chattr +a users.txt lsattr users.txt 31
And we see that the append attribute is set. Now no one, not even root, can change the contents 32
of the file. 33
You can only append or add to the end of the file. 34
It's not permitted and not even root can do that. 35
But I can append to the file. 36
It was permitted! Another useful attribute is`A`, which means no access time updates. When a 37
file with the 'A' attribute set is accessed, its atime record is not modified. 38
This avoids a certain amount of disk input output for the system. 39
This attribute can be set and clear to both by the file owner and root. Let's check the atime of the 40
file: stat user.txt 41
This is the access time and I'm setting the A attribute. 42
I'm listing the attributes; the attribute was set and I'm accessing the file again. 43
Let's check if the atime was updated and we noticed that atime of the file was not updated. 44
And the last attribute I'm going to show you is I, which means imutable, a file with the the 'i' attribute set 45
cannot be modified, it cannot be deleted or renamed, 46
no hard link can be created to the file, 47
most of the file's metadata can not be modified, and no data can be written to the file. 48
The file is frozen. 49
Only the super user has the capability to set or clear this attribute. 50
I'm setting the attribute to another file, sudo chattr +i and the file name. 51
And as root I'm trying to remove the file. 52
It's not permitted or I'm trying to change the file. 53
It is not permitted. 54
I'm trying to append to the file, so to add to its end. 55
It's not permitted either; but is root allowed to change the permissions? 56
It's not allowed! This attribute is useful if you want to avoid the accidental deletion or change 57
of a very important file. 58
Note that you can set these attributes recursively as well: chattr -R +i 59
and the directory's name. And of course I have to run 60
the command as root. 61
lsattr -R dir1/ The R option with a list of the attributes of a directory 62
recursively. It means that it'll show the attributes of the subdirectories contents. 63
They are immutable. 64
Maybe changing file attributes is not a very common administration task, but I think a basic knowledge 65
is required 66
just in case you run into them. 67
Now, if I want to delete the files, I have to clear the immutable attribute first. 68
I'm clearing the attribute and then removing the files.