8

Normal users can chmod files to make them unaccessible like

evgeniy@ubuntu:~$ touch test
evgeniy@ubuntu:~$ chmod 444 test
evgeniy@ubuntu:~$ echo 'test' > test
bash: test: Permission denied

Can something like this be simulated for the root user?

  • I hope not, or I'm sure to do it. – Mark Allen Oct 28 '10 at 8:16
  • Go ahead and check the @danlefree's answer ;) – dolzenko Oct 30 '10 at 7:22
13

chattr +i * will prevent even the root account from making changes to files in the directory (until chattr -i * is run).

Per Slartibartfast's comments, a few things you should know about chattr and the immutable attribute:

  1. The immutable bit will prevent a file from being deleted, renamed, linked to, or written to; use lsattr to display attributes in much the same way ls displays ownership and permissions
  2. You can prevent the immutable bit from being unset (even by root) by changing the CAP_LINUX_IMMUTABLE flag - to do so you'll want to install libcap, but it's only fair warning that capabilities are poorly documented (at best)
  • It is worth mentioning for purposes of helping people find this answer that chattr +i makes the file immutable. – Slartibartfast Oct 29 '10 at 2:20
5

SELinux can be used to mark a file as unwriteable by root in the current domain and user role.

  • Providing an example would be great – Jonathan Mar 24 '17 at 14:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.