Normal users can chmod files to make them unaccessible like

evgeniy@ubuntu:~$ touch test
evgeniy@ubuntu:~$ chmod 444 test
evgeniy@ubuntu:~$ echo 'test' > test
bash: test: Permission denied

Can something like this be simulated for the root user?

  • I hope not, or I'm sure to do it.
    – Mark Allen
    Oct 28, 2010 at 8:16
  • Go ahead and check the @danlefree's answer ;) Oct 30, 2010 at 7:22

2 Answers 2


chattr +i * will prevent even the root account from making changes to files in the directory (until chattr -i * is run).

Per Slartibartfast's comments, a few things you should know about chattr and the immutable attribute:

  1. The immutable bit will prevent a file from being deleted, renamed, linked to, or written to; use lsattr to display attributes in much the same way ls displays ownership and permissions
  2. You can prevent the immutable bit from being unset (even by root) by changing the CAP_LINUX_IMMUTABLE flag - to do so you'll want to install libcap, but it's only fair warning that capabilities are poorly documented (at best)
  • It is worth mentioning for purposes of helping people find this answer that chattr +i makes the file immutable. Oct 29, 2010 at 2:20

SELinux can be used to mark a file as unwriteable by root in the current domain and user role.

  • Providing an example would be great
    – Jonathan
    Mar 24, 2017 at 14:52
  • SELinux must be considered as untrustworthy as OpenSSL with the Heartbleed and RNG patches that came from the same source. (Namely the NSA.) There are alternatives though. The common name for such solutions is “RBAC” (role-based access-control) in specific or “MAC” (mandatory access control) in general.
    – anon
    Nov 8, 2022 at 2:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .