Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Normal users can chmod files to make them unaccessible like

evgeniy@ubuntu:~$ touch test
evgeniy@ubuntu:~$ chmod 444 test
evgeniy@ubuntu:~$ echo 'test' > test
bash: test: Permission denied

Can something like this be simulated for the root user?

share|improve this question
    
I hope not, or I'm sure to do it. –  Mark Allen Oct 28 '10 at 8:16
    
Go ahead and check the @danlefree's answer ;) –  dolzenko Oct 30 '10 at 7:22

2 Answers 2

up vote 12 down vote accepted

chattr +i * will prevent even the root account from making changes to files in the directory (until chattr -i * is run).

Per Slartibartfast's comments, a few things you should know about chattr and the immutable attribute:

  1. The immutable bit will prevent a file from being deleted, renamed, linked to, or written to; use lsattr to display attributes in much the same way ls displays ownership and permissions
  2. You can prevent the immutable bit from being unset (even by root) by changing the CAP_LINUX_IMMUTABLE flag - to do so you'll want to install libcap, but it's only fair warning that capabilities are poorly documented (at best)
share|improve this answer
    
It is worth mentioning for purposes of helping people find this answer that chattr +i makes the file immutable. –  Slartibartfast Oct 29 '10 at 2:20
    
Thanks! SF is amazing :) –  dolzenko Oct 30 '10 at 7:21

SELinux can be used to mark a file as unwriteable by root in the current domain and user role.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.