chattr and lsattr: Make Files Immutable or Append-Only on Linux

By /

Updated for 2026: this started life as a four-command tip. It deserved better — chattr is one of those tools that’s been on every Linux box you’ve ever administered, quietly able to make a file untouchable even by root.

The core idea

Linux filesystems carry a set of extended attributes beyond permissions. Two of them matter most:

  • i — immutable. The file cannot be modified, deleted, renamed, or linked over. By anyone, including root, until the flag is removed.
  • a — append-only. The file can be opened for appending, but existing content can’t be changed or truncated away. Perfect for logs.

Make a file untouchable

[root@server ~]# chattr +i /etc/resolv.conf
[root@server ~]# lsattr /etc/resolv.conf
----i---------e------- /etc/resolv.conf

Now try to edit or delete it — even as root:

[root@server ~]# rm /etc/resolv.conf
rm: cannot remove '/etc/resolv.conf': Operation not permitted

Classic uses: freezing a config that some daemon (or some colleague’s script) keeps overwriting, or hardening files like /etc/passwd and /etc/shadow against casual tampering. When you legitimately need the file back:

[root@server ~]# chattr -i /etc/resolv.conf

Append-only for logs

[root@server ~]# chattr +a /var/log/secure
[root@server ~]# lsattr /var/log/secure
-----a--------e------- /var/log/secure

The logging daemon keeps writing; nobody can rewrite history that’s already in the file — not even root, and not malware running as root, until someone with the right capability removes the flag. Two practical warnings:

  • Log rotation: logrotate’s default rename-and-create breaks on append-only files. Use the copytruncate option for files you protect this way.
  • It’s a speed bump, not a vault: root (specifically, a process with CAP_LINUX_IMMUTABLE) can remove the flag. chattr stops accidents, scripts, and smash-and-grab tampering. It does not stop a determined attacker who owns the box — ship logs off the machine for that.

Directories too

Set +a on a directory and files inside can be created and appended, but not deleted or renamed — a cheap drop-box. Set +i on a directory and nothing inside it can change at all.

Checking what’s set

[root@server ~]# lsattr /etc/            # one file
[root@server ~]# lsattr -R /srv/data      # recursively
[root@server ~]# lsattr -d /var/log       # the directory itself, not its contents

Caveats

  • Works on ext2/3/4, XFS, and btrfs (support for a few exotic flags varies; i and a are the portable ones).
  • Not supported on tmpfs or most network filesystems.
  • Forgetting you set +i is a rite of passage: a package update fails, a config won’t save, and an hour later you remember. lsattr is the first thing to check when a file “can’t be modified” for no obvious reason.

Running your own server? These guides assume you have a Linux box somewhere — see our guide to choosing a VPS in 2026 for the 7 specs that actually matter before you spin one up.

Scroll to Top