[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2qze6ncqcv3tx":3,"$f1graqxzpw2dne":10,"$f37jlpw99hzlx3":23,"$fmtsmx741g587":24},{"tagline":4,"link_x":5,"link_youtube":6,"link_linkedin":7,"link_github":8,"bio":9,"home_header":9,"home_message":9,"avatar_url":9},"Founder & Engineer • Fintech • Blockchain • AI ","https:\u002F\u002Fx.com\u002Fivanermolaev_","https:\u002F\u002Fwww.youtube.com\u002F@GetAuth","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fiermolaev\u002F","https:\u002F\u002Fgithub.com\u002FNawy","",{"id":11,"nanoid":12,"title":13,"content":14,"excerpt":15,"createdAt":16,"updatedAt":17,"tags":18},"019ffbf0-a08e-7679-850a-e7080962807a","zeDwEi88Au","How to Make Linux Files Undeletable Even for Root Users","# How to Make Linux Files Immutable (Even Root Can't Touch Them!)\n\nMost Linux users believe that the **root** user is all-powerful. Root can read any file, write to any file, and delete any file. But what if you could create a file that even root cannot modify or delete?\n\nThis isn't a myth. Linux has a built-in feature that lets you lock a file so tightly that not even superuser privileges can break it. In this article, you will learn how to use the `chattr` command to make files **immutable**, why this is incredibly useful for security, and how to apply it to protect critical system files.\n\n## Prerequisites\n\nBefore you start, make sure you have:\n\n- Access to a Linux terminal.\n- **Root or sudo privileges** (you need these to set the lock, ironically).\n- Basic familiarity with Linux file permissions.\n\n## What is `chattr`?\n\n`chattr` stands for **change attribute**. Unlike `chmod` (which changes *permissions* like read, write, and execute), `chattr` changes special *file system attributes* that control how the file behaves at a much deeper level.\n\nThese attributes are enforced by the file system itself (like ext4), not just by the standard Unix permission model. This is why they can override even root's authority.\n\n## The Immutable Attribute: `+i`\n\nThe most powerful attribute available is `i`, which stands for **immutable**.\n\nWhen a file has the immutable attribute set:\n\n- It **cannot be modified** (no writing).\n- It **cannot be deleted**.\n- It **cannot be renamed**.\n- No new **links** can be created to it.\n- Its metadata (like timestamps) **cannot be changed**.\n\nHere is the official definition from the Linux man pages:\n\n> \"A file with the 'i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Only the superuser or a process possessing the `CAP_LINUX_IMMUTABLE` capability can set or clear this attribute.\"\n\n### How to Lock a File\n\nTo make a file immutable, use the `+i` flag with `chattr`:\n\n```shell\n# Lock the file\nsudo chattr +i \u002Fpath\u002Fto\u002Fyour\u002Ffile.txt\n```\n\nOnce this command runs, try to edit or delete the file. You will get a **\"Permission denied\"** error, even if you are logged in as root.\n\n### How to Check the Status\n\nYou can verify if a file is locked using the `lsattr` (list attributes) command:\n\n```shell\nlsattr \u002Fpath\u002Fto\u002Fyour\u002Ffile.txt\n```\n\nIf the file is immutable, you will see an `i` in the output, like this:\n`----i---------e--- \u002Fpath\u002Fto\u002Fyour\u002Ffile.txt`\n\n### How to Unlock a File\n\nIf you need to edit the file later, you must remove the attribute using `-i`:\n\n```shell\n# Unlock the file\nsudo chattr -i \u002Fpath\u002Fto\u002Fyour\u002Ffile.txt\n```\n\nOnce unlocked, the file returns to normal, and you can edit or delete it as usual.\n\n## Why Should You Use This? Protecting Against Rootkits\n\nYou might be wondering: \"If I trust myself as root, why do I need to lock myself out?\"\n\nThe answer is **security against attackers**, specifically **rootkits** and malware. If a hacker gains root access to your server, one of the first things they often do is:\n\n1.  Create a new hidden user (a backdoor).\n2.  Change a password to gain access to an existing account.\n\nThey do this by editing two critical files:\n- `\u002Fetc\u002Fpasswd` (Stores user login information).\n- `\u002Fetc\u002Fshadow` (Stores encrypted password hashes).\n\nIf you make these files immutable, even a rootkit with root privileges **cannot add new users or change passwords** through standard file editing methods. This can stop certain attacks in their tracks.\n\n### Practical Example: Locking `passwd` and `shadow`\n\nHere is how you would apply this security measure to protect your login credentials:\n\n```shell\n# Lock the user database file\nsudo chattr +i \u002Fetc\u002Fpasswd\n\n# Lock the password hash file\nsudo chattr +i \u002Fetc\u002Fshadow\n```\n\nNow, if malware tries to run a command like `useradd` to create a new hacker account, the system will throw an error because it cannot write to these files.\n\n**Important:** If you legitimately need to add a new user or change a password, you must remember to unlock these files first, or the standard `useradd`\u002F`passwd` commands will fail!\n\n```shell\n# Remember to unlock before making legitimate changes!\nsudo chattr -i \u002Fetc\u002Fpasswd\nsudo chattr -i \u002Fetc\u002Fshadow\n\n# Now you can add users normally\nsudo useradd newuser\n\n# Lock it again immediately after!\nsudo chattr +i \u002Fetc\u002Fpasswd\nsudo chattr +i \u002Fetc\u002Fshadow\n```\n\n## A Word of Caution\n\nWhile `chattr +i` is powerful, it is not a magic bullet:\n\n- **It relies on the filesystem:** This feature works on `ext2\u002F3\u002F4`, `btrfs`, and `XFS`, but might behave differently or not be supported on other filesystems.\n- **Physical access bypasses it:** If an attacker boots your server using a live USB\u002FCD, they can mount your hard drive using a *different* operating system kernel, which might ignore the immutable flag, or they could use tools to alter it directly.\n- **It can break automation:** If you have scripts that update `\u002Fetc\u002Fpasswd` (like automated user provisioning), the immutable flag will cause those scripts to fail. Always test in a safe environment first.\n\n## Conclusion\n\nThe `chattr` command with the `+i` flag is a hidden gem in Linux system administration. It provides a layer of defense that goes beyond standard user permissions, protecting critical files from accidental changes and malicious rootkits alike.\n\n**Next Steps:** Try setting the immutable flag on a test file first to see how the \"Permission Denied\" error looks. Once you are comfortable, consider auditing your `\u002Fetc\u002Fpasswd` and `\u002Fetc\u002Fshadow` files and locking them down for an extra layer of security on your production servers.","Use chattr +i to make Linux files immutable, preventing deletion, modification, or renaming even by root users. Ideal for protecting critical system files like \u002Fetc\u002Fpasswd and \u002Fetc\u002Fshadow from rootkit attacks and unauthorized changes.","2026-08-13T16:24:38.000Z","2026-08-13T16:26:57.000Z",[19],{"id":20,"name":21,"slug":21,"colorHex":22},6,"security","#5aa329",{"tagline":4,"link_x":5,"link_youtube":6,"link_linkedin":7,"link_github":8,"bio":9,"home_header":9,"home_message":9,"avatar_url":9},[]]