Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have real world scenarios where they've used the immutable flag in Linux?

chattr +i file.txt

Since root can unset the attribute, it seems like you're protecting the file against users who have root access but aren't aware of the feature.

share|improve this question

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

closed as not constructive by Sven, mdpc, mgorven, Zoredache, Michael Hampton Oct 25 '12 at 22:14

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 8 down vote accepted

I've seen this used in virtual hosting setups where file(s) need to remain in directories that users have access to, e.g. php5.fcgi. I also occasionally use it to add an extra step to deleting important files, to protect them from my own absent-mindedness.

share|improve this answer

I use this on any directory that is only intended to be a mount point. It prevents files from mistakenly getting written if the file system isn't mounted.

share|improve this answer
Nice. I've never seen that use before. – ewwhite Oct 25 '12 at 19:26
Yep, that's slick – xofer Oct 25 '12 at 20:54

It's quite handy for for hacking someone else's systems and keeping your trojaned binaries from being deleted!!

share|improve this answer
As a corollary it's very often used to prevent someone from installing trojaned binaries in the first place -- e.g. on FreeBSD most key programs are installed system-immutable (and if you run with a securelevel >=1 you can't turn the flag off without rebooting into single-user mode) – voretaq7 Oct 25 '12 at 21:53
This BSD thing sounds interesting... It's almost like Linux, but with more useful stuff! – ewwhite Oct 25 '12 at 21:54
Like an actual production-ready operating system even! :-) The chflags man page has details on the basic flags (more goodies can be done with ACLs, as in Linux), & there's a whole page on security which describes the securelevel functionality. – voretaq7 Oct 25 '12 at 21:58

Usually to protect against automatic deletion of the file, eg. through cleaning of temporary directories etc. though of course you have to hope whatever might delete that file behaves well on failure :)

share|improve this answer
The immutable flag wouldn't be my choice here unless you also want to protect against changes -- remember a file that has been chattr +i'd is immutable - you can't write, delete, truncate, append... – voretaq7 Oct 25 '12 at 22:00

To keep pesky developers and hacking sysadmins off your ish.

share|improve this answer
Care to elaborate? This answer really isn't all that useful in the current state. – Zoredache Oct 25 '12 at 22:11

protected by voretaq7 Oct 25 '12 at 22:07

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.