I know this may sound strange, but I need to allow only scripts to write to a certain file.

The file is owned by root, and some users have sudo or root access. They sometimes edit the file by hand, but this is wrong, because there are some scripts that edit the file correctly (while such users do it incorrectly).

So, I'd like that only those scripts have the right to edit the file, while any user can't edit, but only read that file.

Is it possible to do something like this? I know this is silly because they have admin rights, but, at least I'd like to make it hard to edit the files by hand... The scripts can be modified, of course, so if it's possible to obtain a "script-only access token" which grant the write access to such file, the scripts can be changed accordingly.

  • Thanks for the feedback so far about the immutable bit, but I thought that having a more general strategy that doesn't involve editing the scripts would be even better and more usable, so I'll wait a bit if someone comes up with another solution of that kind. – AkiRoss Jan 3 '13 at 18:36

Since your "some users" have sudo or root access to the machine, it is not fully possible. Because every thing you doing as root can revert by them. So, the only thing you can do is attributing. So it makes them some difficulty to modify the files, but still its not fully proof because of the same reason I mentioned in first sentence.

Using following command you can set attributes to file:

chattr +i /path/to/file

where +i mean immutable. So no one can edit the file without removing attribute. So in you script you do like following:

chattr -i /path/to/file # remove the immutable attribute of the file at the beginning of your script
chattr +i /path/to/file # attribute the file at the end of your script

Examples :



  • Thanks, it's good to know about the immutable bit. I'll think about it some more to see if helps. – AkiRoss Jan 3 '13 at 18:32

If they have root access, all bets are pretty much off..depending how savvy they are. One ugly way is to set immutable bit on your file. It will be unmodifiable as long as that attribute is set. Then change your scripts to remove that attribute before updating your file and set it back afterwards. Hopefully your users won't notice that attribute and their attempts at editing will be futile.

And obviously, the biggest thing is user education. We shouldn't ban hammers because idiots keep smashing their thumbs ;)


Have the script make the first line of the file


As others have noted, if they have root, you can't stop them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.