Home / server / Questions / 195693
Accepted
dolzenko
Asked: 2010-10-29 00:09:47 +0800 CST

How can root user create file/directory unwritable for itself?

  • 772

Normal users can chmod files to make them unaccessible like

evgeniy@ubuntu:~$ touch test
evgeniy@ubuntu:~$ chmod 444 test
evgeniy@ubuntu:~$ echo 'test' > test
bash: test: Permission denied

Can something like this be simulated for the root user?

linux filesystems permissions

2 Answers

  1. Best Answer

    chattr +i * will prevent even the root account from making changes to files in the directory (until chattr -i * is run).

    Per Slartibartfast's comments, a few things you should know about chattr and the immutable attribute:

    1. The immutable bit will prevent a file from being deleted, renamed, linked to, or written to; use lsattr to display attributes in much the same way ls displays ownership and permissions
    2. You can prevent the immutable bit from being unset (even by root) by changing the CAP_LINUX_IMMUTABLE flag - to do so you'll want to install libcap, but it's only fair warning that capabilities are poorly documented (at best)
    • 13

  2. SELinux can be used to mark a file as unwriteable by root in the current domain and user role.

    • 5