Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 7 down vote favorite

Does anyone have real world scenarios where they've used the immutable flag in Linux?

chattr +i file.txt

Since root can unset the attribute, it seems like you're protecting the file against users who have root access but aren't aware of the feature.

share|improve this question

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer: please explain why you're recommending it as a solution. Answers that don't explain anything will be deleted. See Good Subjective, Bad Subjective for more information.

closed as not constructive by SvW, mdpc, mgorven, Zoredache, Michael Hampton Oct 25 '12 at 22:14

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

5 Answers

up vote 8 down vote accepted

I've seen this used in virtual hosting setups where file(s) need to remain in directories that users have access to, e.g. php5.fcgi. I also occasionally use it to add an extra step to deleting important files, to protect them from my own absent-mindedness.

share|improve this answer
up vote 10 down vote

I use this on any directory that is only intended to be a mount point. It prevents files from mistakenly getting written if the file system isn't mounted.

share|improve this answer
2  
Nice. I've never seen that use before. – ewwhite Oct 25 '12 at 19:26
Yep, that's slick – xofer Oct 25 '12 at 20:54
up vote 0 down vote

Usually to protect against automatic deletion of the file, eg. through cleaning of temporary directories etc. though of course you have to hope whatever might delete that file behaves well on failure :)

share|improve this answer
The immutable flag wouldn't be my choice here unless you also want to protect against changes -- remember a file that has been chattr +i'd is immutable - you can't write, delete, truncate, append... – voretaq7♦ Oct 25 '12 at 22:00
up vote 4 down vote

It's quite handy for for hacking someone else's systems and keeping your trojaned binaries from being deleted!!

share|improve this answer
As a corollary it's very often used to prevent someone from installing trojaned binaries in the first place -- e.g. on FreeBSD most key programs are installed system-immutable (and if you run with a securelevel >=1 you can't turn the flag off without rebooting into single-user mode) – voretaq7♦ Oct 25 '12 at 21:53
This BSD thing sounds interesting... It's almost like Linux, but with more useful stuff! – ewwhite Oct 25 '12 at 21:54
Like an actual production-ready operating system even! :-) The chflags man page has details on the basic flags (more goodies can be done with ACLs, as in Linux), & there's a whole page on security which describes the securelevel functionality. – voretaq7♦ Oct 25 '12 at 21:58
up vote -2 down vote

To keep pesky developers and hacking sysadmins off your ish.

share|improve this answer
Care to elaborate? This answer really isn't all that useful in the current state. – Zoredache Oct 25 '12 at 22:11

protected by voretaq7♦ Oct 25 '12 at 22:07

This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.

Not the answer you're looking for? Browse other questions tagged or ask your own question.