Linux online course

Change File Attributes with chattr in Linux

Learn how to inspect and change Linux file attributes with lsattr and chattr, including immutable, append-only, no-atime, no-dump, compression, and secure-deletion flags.

Linux file attributes are filesystem-level flags that change how files and directories behave. They are separate from ordinary ownership and rwx permission bits. For example, a file can be writable according to its permissions but still reject changes because its immutable attribute is set.

This lesson covers lsattr for inspection and chattr for changing supported attributes. The exact behavior depends on the filesystem, kernel, mount configuration, and attribute implementation. Always test an attribute on a disposable file before applying it to an important path.

What Linux file attributes do

File attributes are flags stored and enforced by a filesystem. They are different from user, group, and permission information, and they are also distinct from user-defined extended attributes managed with tools such as setfattr and getfattr.

Think of file control as several separate layers:

• Ownership: identifies the file owner and group.
• Permission bits: control ordinary read, write, and execute access.
• ACLs: provide more detailed access rules when supported.
• Filesystem attributes: impose behavior such as immutable or append-only operation.

These layers interact. A process that has permission to write a file can still be denied if the filesystem enforces an attribute that prohibits the requested operation. However, attributes are not a complete security boundary. A privileged administrator can generally remove them, and a compromised system with root-level control may be able to bypass or alter them.

Support is not universal. A requested flag may fail because the filesystem does not implement it, the kernel or mount environment does not expose it, or the target is on a network, container-provided, virtualized, or special filesystem.

Inspecting attributes with lsattr

lsattr displays the attribute flags currently applied to files and directories. Start by establishing a baseline:

lsattr /path/to/file

A typical result has a sequence of flag positions followed by the path. The exact displayed sequence can vary by implementation, but a visible i indicates immutable mode, a indicates append-only mode, and so on.

Inspect a directory tree with:

lsattr -R /path/to/directory

Use this command before and after a change. The before-state is especially important when you plan to use the replacement operator (=) or make recursive changes.

Changing attributes with chattr

chattr changes supported filesystem attributes. Its basic structure is:

chattr [operator][flags] file

Administrative privileges are normally required for protected files and for attributes such as immutable and append-only. Use sudo when authorized:

sudo chattr +i /path/to/file

Attribute operators

Multiple supported flags can be combined. For example, +iA requests immutable mode and suppression of access-time updates. Do not assume every combination is supported or meaningful on every filesystem.

Common chattr flags

Protect a file with the immutable attribute

The immutable flag, i, prevents most changes to a file until the flag is removed. This includes editing contents, deleting, renaming, creating links to, and changing most metadata for the file. A process may have ordinary write permission and still receive an operation-not-permitted error.

Use a harmless test file:

printf '%s\n' 'original content' > ~/attribute-test.txt
lsattr ~/attribute-test.txt
sudo chattr +i ~/attribute-test.txt
lsattr ~/attribute-test.txt

After the flag appears, test a write or deletion. The operation should fail while the flag is active:

printf '%s\n' 'new content' > ~/attribute-test.txt
rm ~/attribute-test.txt

For authorized maintenance, remove the flag, make the change, and restore protection:

sudo chattr -i ~/attribute-test.txt
printf '%s\n' 'maintained content' > ~/attribute-test.txt
sudo chattr +i ~/attribute-test.txt
lsattr ~/attribute-test.txt

Immutable mode is useful for a critical configuration file or another path that should not change during normal operation. It is not a substitute for backups, access control, auditing, vulnerability management, or broader system security.

Use append-only mode for logs

The append-only flag, a, permits adding data at the end of a file while preventing modification of existing contents and truncation. Deleting or renaming the file is also restricted while the flag is active.

sudo chattr +a /path/to/logfile
lsattr /path/to/logfile

A logging process that opens the file for append may continue to add entries, while an operation that replaces, truncates, or edits earlier entries should fail. Test the exact application and log rotation design first. Some rotation tools rename or replace files and therefore need a planned procedure, such as temporarily removing the flag with appropriate privileges.

sudo chattr -a /path/to/logfile
# perform authorized log maintenance or rotation
sudo chattr +a /path/to/logfile

Append-only mode can strengthen protection against accidental alteration, but it does not make logs trustworthy on a compromised host. An attacker with sufficient privilege may remove the flag or modify the system that records and forwards the logs.

Suppress access-time updates with A

atime is access-time metadata: a timestamp associated with the most recent read or similar access. The A attribute requests that access-time metadata not be updated for the marked file.

sudo chattr +A /path/to/file
lsattr /path/to/file

Suppressing per-file atime updates can reduce metadata writes for frequently read data, which may matter for storage activity and battery-conscious systems. Verify behavior by inspecting timestamps before and after a controlled read, while remembering that filesystem timestamp rules and mount options also affect results.

This per-file setting is not the same as mounting a filesystem with noatime or relatime. Mount options apply broader policies, whereas A targets individual entries where supported.

No-dump mode and backup verification

The d flag tells traditional dump-based backup tooling to skip the file. Apply it with:

sudo chattr +d /path/to/file

Do not assume that a modern backup program honors this flag. Many backup products use their own file traversal and exclusion rules. Check the product documentation, inspect job output, and perform a controlled backup and restore test. If a file must be excluded, configure the exclusion in the backup system itself.

Compression-related flag c

The c flag has a historical purpose: requesting filesystem or kernel-managed compression for file data. It is filesystem-specific and often unsupported or unusable on common modern Linux filesystems.

Do not treat chattr +c as a portable compression command. Identify the filesystem, read its documentation, and test on disposable data. Use the filesystem's documented compression feature or an application-level compression format when appropriate.

Why s is not reliable secure deletion

The s flag was historically intended to clear file data blocks during deletion. That behavior is not a dependable secure-erasure method on current systems.

• Copy-on-write filesystems may retain older blocks or snapshots.
• SSDs and other flash devices use wear leveling, so an overwrite may not reach the original physical cells.
• Journaling filesystems can retain data in journals or metadata structures.
• Encryption layers, replicas, snapshots, and backups can preserve copies elsewhere.

For sensitive data, use a documented sanitization process appropriate to the storage medium and applicable requirements. For future protection, encryption combined with controlled key destruction is often more reliable than attempting to overwrite individual files.

Multiple flags and replacement safety

Add or remove flags without disturbing unrelated state when possible:

sudo chattr +iA /path/to/file
lsattr /path/to/file
sudo chattr -A /path/to/file

The last command removes only A and retains i. By contrast, a command using = replaces the complete set:

lsattr /path/to/file
sudo chattr =i /path/to/file
lsattr /path/to/file

Before using =, record the existing output and understand every flag you intend to preserve. Replacement can silently clear flags that another administrator or application requires.

Directories and recursive changes

Attributes can be applied to directories, but the effect may differ from applying the same flag to a regular file. For example, immutable mode on a directory restricts operations involving entries in that directory, such as creating, deleting, or renaming entries; it does not simply mean that every file inside is individually immutable.

Use recursive mode with extreme care:

lsattr -R /path/to/test-directory
sudo chattr -R +i /path/to/test-directory
lsattr -R /path/to/test-directory

Only use this demonstration with a clearly disposable test tree. A safe recursive workflow is:

1. Inspect the exact path and list the files that may be affected.
2. Record current attributes with lsattr -R.
3. Test the command on a small disposable tree.
4. Apply the change to the intended scope only.
5. Verify every affected entry afterward.
6. Maintain a reversal plan, such as removing only the flag you added.

A broad recursive command can lock configuration, runtime, cache, or log files unexpectedly. Using = recursively is particularly dangerous because it can overwrite pre-existing attribute combinations.

Recover from an undeletable or uneditable file

If an expected administrator workflow cannot edit, rename, or delete a file, inspect its attributes first:

lsattr /path/to/file
findmnt -T /path/to/file

An i flag suggests immutable mode; an a flag suggests append-only mode. findmnt helps identify the filesystem and whether the mount is read-only. If authorized, remove the applicable flag and retry:

sudo chattr -i /path/to/file
sudo chattr -a /path/to/file

Remove only the flag that is actually causing the problem. If the mount is read-only, resolve that condition instead of repeatedly retrying chattr. Preserve the original attribute state when the file is supposed to remain protected.

Troubleshooting guide

Safe administration checklist

• Use a disposable file or directory for initial testing.
• Run lsattr before and after every important change.
• Use + or - when you want to preserve unrelated flags.
• Record existing attributes before using =.
• Confirm the filesystem type and mount mode when support or writeability is uncertain.
• Plan maintenance for applications such as log rotation before enabling a.
• Verify backup behavior instead of assuming d is honored.
• Do not rely on s for modern secure erasure.
• Remember that attributes mainly protect against accidental or less-privileged changes, not a fully compromised root-controlled system.

Summary

lsattr shows filesystem attributes, while chattr changes them. The + operator adds flags, - removes them, and = replaces the complete set. Immutable mode (i) blocks most changes, append-only mode (a) protects existing log data, and A suppresses per-file access-time updates. The d, c, and s flags are highly dependent on tooling, filesystem, and storage behavior. Inspect first, test safely, verify afterward, and maintain a documented way to reverse every administrative change.