VMware ESXi and vSphere Cluster Management

Change File Attributes with chattr in Linux

Learn how to view and change Linux file attributes with chattr and lsattr, including immutable, append-only, no-atime, no-dump, compression, and secure-deletion flags.

Linux file attributes are filesystem-level flags that change how files and directories are handled. They are separate from standard permission bits, ownership, and access control lists (ACLs). The chattr command changes supported attributes, while lsattr displays them.

Attributes can prevent modification, deletion, or renaming, restrict writes to appends, suppress access-time updates, or influence backup and compression behavior. Availability depends on the filesystem, kernel, mount options, and your privileges.

What File Attributes Control

Traditional permissions answer questions such as “May this user read, write, or execute this file?” Ownership identifies the file’s user and group, and ACLs provide additional permission rules. File attributes add filesystem-specific restrictions that operate independently of those mechanisms.

For example, a file can be writable according to its mode bits but still reject changes because it has the immutable attribute. Running chmod does not remove an immutable or append-only restriction.

The chattr and lsattr Commands

chattr is the Linux utility used to add, remove, or replace supported file attributes. Its basic syntax is:

chattr [operator][attributes] file...

Administrative privileges are commonly required, especially when changing protected files or setting the immutable flag:

sudo chattr +i /path/to/file

You can specify one file or several files:

sudo chattr +A file-one file-two file-three

Use lsattr to inspect the current state:

lsattr /path/to/file

The output contains positions for supported attributes. A dash or blank position means that the corresponding attribute is not enabled. The exact displayed columns depend on the utility and filesystem.

Inspect Before and After a Change

lsattr /etc/example.conf
sudo chattr +i /etc/example.conf
lsattr /etc/example.conf

Always verify the result with lsattr, particularly after using the equals operator, which can clear attributes that you did not intend to change.

Attribute Operators

Operator: + — Adds the specified attributes and preserves other enabled attributes. Example: chattr +i file.

Operator: - — Removes the specified attributes and preserves other enabled attributes. Example: chattr -i file.

Operator: = — Replaces the attribute set with the specified attributes. Other attributes may be cleared. Example: chattr =i file.

The plus operator is usually the safest choice when you want to add one protection without disturbing existing settings. Use the equals operator only when you intentionally want to define the complete attribute set.

Immutable Attribute: i

The i attribute makes a file immutable. While it is set, the file cannot normally be modified, deleted, renamed, linked, or written to. This remains true even if ordinary permission bits appear to allow those operations.

Use it for carefully controlled protection of critical configuration files or records:

sudo chattr +i /path/to/important-file
lsattr /path/to/important-file

Before editing, replacing, or deleting the file, remove the flag:

sudo chattr -i /path/to/important-file
# Perform the authorized maintenance
sudo chattr +i /path/to/important-file

Immutable protection is not a replacement for backups, access control, monitoring, or host security. An administrator with appropriate authority may remove the flag, and a compromised system may not be trustworthy.

Append-Only Attribute: a

The a attribute permits data to be added at the end of a file but normally blocks overwriting, truncation, renaming, and deletion while enabled. Logs and audit-style records are common use cases.

sudo chattr +a /var/log/example-audit.log
lsattr /var/log/example-audit.log

An application must open the file using append semantics. An application that expects to truncate or replace the file may fail even when its standard permissions are correct.

Log rotation and maintenance often require temporary removal of the flag:

sudo chattr -a /var/log/example-audit.log
# Rotate, replace, or otherwise maintain the log
sudo chattr +a /var/log/example-audit.log

Other Common Attributes

i — Immutable: Prevents normal modification, deletion, renaming, linking, and writing. Useful for controlled protection, but it can disrupt updates and is not a complete security boundary.

a — Append-only: Allows appending but blocks ordinary overwrite, truncation, deletion, and renaming. Useful for logs; applications must write in append mode.

A — No atime updates: Suppresses access-time updates for the marked file or directory where supported. It may reduce metadata writes, but measurable performance or battery benefits are not guaranteed on modern systems.

d — No dump: Requests that the legacy dump backup utility skip the file. Modern backup software may ignore this flag.

c — Compressed: A compression-related attribute on filesystems and kernels that support it. It may not provide transparent compression on commonly used configurations.

s — Secure deletion: Historically intended to zero file data blocks when a marked file is deleted. It is not a dependable sanitization method on modern storage.

No-atime Updates and Mount Options

Access time, or atime, is metadata recording when a file or directory was read. chattr +A file applies the no-atime behavior to an individual item where supported:

sudo chattr +A /path/to/file

This differs from filesystem-wide mount options such as noatime and relatime. Mount options affect a mounted filesystem, while A is associated with a particular file or directory. Test behavior on your filesystem instead of assuming a performance improvement.

No-Dump and Backup Policies

The d flag was designed for the legacy dump utility. It does not universally exclude a file from modern backup products. Before using it, determine whether the actual backup tool recognizes the flag, and test both backup and restore behavior. Never mark important data as no-dump without understanding the resulting backup risk.

Compression Support

The intended meaning of c is filesystem-controlled compression. Support is filesystem-specific, and the flag may be ignored or unsupported on a commonly used filesystem. Check local filesystem documentation and test with harmless data before relying on it.

Why Secure Deletion Is Unreliable

The historical intent of s was to zero data blocks when a file was deleted. Modern storage stacks can retain data in filesystem journals, copy-on-write versions, snapshots, thin-provisioned storage, backups, or remapped SSD blocks. SSD wear leveling can also prevent a logical overwrite from reaching every physical cell.

Do not present s as reliable sanitization for sensitive information. For stronger disposal requirements, use encryption with appropriate key destruction and a documented sanitization procedure for the specific storage medium and platform.

Combining and Replacing Attributes

Several supported attributes can be supplied together:

sudo chattr +iA /path/to/file
lsattr /path/to/file

This adds both immutable and no-atime behavior without intentionally clearing other existing attributes.

By contrast, the equals operator replaces the current set:

sudo chattr =i /path/to/file
lsattr /path/to/file

In this example, attributes other than i may be removed. Verify the output and use = only when that replacement is deliberate.

Directories and Recursive Changes

Attributes can be applied to directories. The effect may concern operations within the directory and varies by filesystem and attribute. The recursive option, -R, applies a change to a directory tree where supported:

sudo chattr -R +i /path/to/directory

A safe test sequence is:

mkdir -p /tmp/chattr-lab
touch /tmp/chattr-lab/sample.txt
lsattr /tmp/chattr-lab/sample.txt
sudo chattr +i /tmp/chattr-lab/sample.txt
sudo chattr -i /tmp/chattr-lab/sample.txt

Permissions, Ownership, ACLs, and Attributes

Standard permissions — Managed with chmod; control read, write, and execute access for user, group, and others. Example: removing write permission. Elevated users may bypass many permission checks.

Ownership — Managed with chown and chgrp; identifies the file owner and group and influences permission evaluation. Changing ownership normally requires administrative authority.

ACLs — Managed with tools such as setfacl and getfacl; provide additional fine-grained access rules. ACL changes do not necessarily remove filesystem attributes.

chattr file attributes — Managed with chattr; can impose filesystem-level restrictions such as immutable or append-only behavior. Required authorization and root behavior vary by system.

The usual maintenance sequence is: inspect attributes, remove the restrictive flag with authorized elevated access, perform the maintenance, verify the result, and optionally restore the flag.

Filesystem Support and Safe Administration

Supported flags differ among filesystems, kernel versions, mount configurations, network filesystems, removable media, overlay filesystems, and other special storage systems. Identify the filesystem associated with a path:

findmnt -T /path/to/file
stat -f -c %T /path/to/file

Test a harmless file in a temporary location before changing production data. Document the path, attribute change, reason, operator, date, and undo procedure. Confirm that editors, package managers, log rotation, backup jobs, deployment tools, and monitoring agents can still perform their work.

Do not make package-managed or actively updated system files immutable unless there is a documented procedure for removing the flag before updates and restoring it afterward.

Troubleshooting

A File Cannot Be Edited, Removed, or Renamed

Check the file and relevant parent directory with lsattr. An i flag may be set on the file, a directory may have a restrictive attribute, or the filesystem may be mounted read-only:

lsattr /path/to/file
lsattr -d /path/to/parent-directory
findmnt -T /path/to/file

If the immutable flag is present and the change is authorized, run sudo chattr -i /path/to/file, perform maintenance, and restore it only if appropriate.

A Log Cannot Be Rotated or Truncated

Inspect the log with lsattr. If a is set, the application may also be opening the file without append semantics. Temporarily remove the flag with sudo chattr -a /path/to/log, complete the authorized rotation or replacement, and reapply it if the workflow requires append-only protection.

Operation Not Supported

The filesystem, kernel, or driver may not implement the requested attribute. Network, removable, overlay, and special filesystems often have limited support. Identify the filesystem with findmnt or stat, consult its documentation, and test a harmless file. Do not rely on an unsupported flag for protection.

Insufficient Permissions

Confirm your identity and approved privilege-escalation method. Changing protected attributes commonly requires administrative access, but exact authorization behavior varies. Also check whether the filesystem is mounted read-only. Use elevated access only when authorized.

A Backup Excludes a File Marked d

Determine which backup utility is in use and whether it honors the legacy no-dump flag. Check backup logs and perform restore tests. Remove d if a compatible workflow must include the file, or configure the actual backup tool explicitly rather than assuming universal support.

Secure Deletion Did Not Meet Expectations

Review the filesystem, storage technology, snapshots, journals, backups, and encryption state. The s attribute cannot reliably erase every physical or copied representation. Use storage-specific sanitization procedures and encryption with planned key destruction for future sensitive data.

Practical Workflow

1. Identify the target: Confirm the absolute path and whether the file is actively used.
2. Inspect: Run lsattr and identify the filesystem with findmnt -T.
3. Test: Reproduce the intended behavior in a temporary directory.
4. Apply minimally: Prefer + or - when changing one attribute.
5. Verify: Run lsattr again and test the expected operation.
6. Document: Record the reason, scope, privileges, and undo command.
7. Plan maintenance: Ensure there is a procedure to remove restrictive flags before editing, rotation, replacement, or deletion.

Key Exam and Administration Notes

• chattr changes filesystem attributes; lsattr displays them.
• + adds attributes, - removes them, and = replaces the complete set.
• i means immutable; a means append-only.
• A is a per-item no-atime attribute and is different from mount-wide noatime.
• d targets the legacy dump utility and is not universally understood by modern backup software.
• c and s are highly dependent on filesystem and storage behavior.
• Permissions that appear correct do not override immutable or append-only restrictions.
• Use -R carefully, especially with +i or +a.
• Always verify changes and maintain an authorized procedure for undoing them.

For related access controls, compare file attributes with Linux permissions, ownership, and ACL-based controls before choosing a protection mechanism.