Does anyone have real world scenarios where they've used the immutable flag in Linux?

chattr +i file.txt

Since root can unset the attribute, it seems like you're protecting the file against users who have root access but aren't aware of the feature.

5 Answers 5


I've seen this used in virtual hosting setups where file(s) need to remain in directories that users have access to, e.g. php5.fcgi. I also occasionally use it to add an extra step to deleting important files, to protect them from my own absent-mindedness.


I use this on any directory that is only intended to be a mount point. It prevents files from mistakenly getting written if the file system isn't mounted.

  • 3
    Nice. I've never seen that use before.
    – ewwhite
    Oct 25, 2012 at 19:26
  • Yep, that's slick
    – xofer
    Oct 25, 2012 at 20:54

It's quite handy for for hacking someone else's systems and keeping your trojaned binaries from being deleted!!

  • As a corollary it's very often used to prevent someone from installing trojaned binaries in the first place -- e.g. on FreeBSD most key programs are installed system-immutable (and if you run with a securelevel >=1 you can't turn the flag off without rebooting into single-user mode)
    – voretaq7
    Oct 25, 2012 at 21:53
  • This BSD thing sounds interesting... It's almost like Linux, but with more useful stuff!
    – ewwhite
    Oct 25, 2012 at 21:54
  • Like an actual production-ready operating system even! :-) The chflags man page has details on the basic flags (more goodies can be done with ACLs, as in Linux), & there's a whole page on security which describes the securelevel functionality.
    – voretaq7
    Oct 25, 2012 at 21:58

Usually to protect against automatic deletion of the file, eg. through cleaning of temporary directories etc. though of course you have to hope whatever might delete that file behaves well on failure :)

  • The immutable flag wouldn't be my choice here unless you also want to protect against changes -- remember a file that has been chattr +i'd is immutable - you can't write, delete, truncate, append...
    – voretaq7
    Oct 25, 2012 at 22:00

To keep pesky developers and hacking sysadmins off your ish.

  • Care to elaborate? This answer really isn't all that useful in the current state.
    – Zoredache
    Oct 25, 2012 at 22:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.