Prevent File/Directory Modification, Deletion and Renaming in Linux

In order to prevent a file or directory from being accidentally or intentionally modified, renamed or deleted in Linux, we can set the immutable flag which will disable this functionality.

About the immutable flag

The immutable flag is an extended file system attribute, and can be set on both files and directories. With this flag in place, the file or directory cannot be modified, renamed or deleted without first removing the immutable flag. Setting this flag requires root privileges.


In the following example, we create a new empty file called ‘no-edit.txt’.

[[email protected] ~]# touch no-edit.txt

We can use the lsattr command on this file to view its extended attributes, in this case only ‘e’ is there by default.

[[email protected] ~]# lsattr no-edit.txt
--------------e---- no-edit.txt

Next we’ll write some data to the file, which works as expected.

[[email protected] ~]# echo test >> no-edit.txt
[[email protected] ~]# cat no-edit.txt

Now we use the chattr command to set the ‘i’ flag, where i represents immutable.

[[email protected] ~]# chattr +i no-edit.txt

We can now run the lsattr command again to confirm that the ‘i’ flag is now listed on the file.

[[email protected] ~]# lsattr no-edit.txt    
----i---------e---- no-edit.txt

The no-edit.txt file is now immutable, so let’s try and write more data to it and see if we can delete or rename it.

[[email protected] ~]# echo more-test >> no-edit.txt
zsh: operation not permitted: no-edit.txt
[[email protected] ~]# rm -f no-edit.txt
rm: cannot remove 'no-edit.txt': Operation not permitted
[[email protected] ~]# mv no-edit.txt no-edit2.txt
mv: cannot move 'no-edit.txt' to 'no-edit2.txt': Operation not permitted

As we can see in this example, we are not able to modify, delete, or rename our test file as it has been set to immutable. This works exactly the same when applying the ‘i’ flag to a folder, however if you do make a folder immutable, this will apply to all of the files inside, meaning that any sub directories or files within the immutable directory cannot be modified.

If you want to be able to change, remove, or rename an immutable file or directory, you must first remove the ‘i’ flag. This is done again using the change attribute (chattr) command, as shown below.

[[email protected] ~]# chattr -i no-edit.txt
[[email protected] ~]# lsattr no-edit.txt
--------------e---- no-edit.txt

At this point we can now edit, delete or rename the no-edit.txt file as it is no longer immutable.


In Linux we can set the immutable flag on a file or directory with the ‘chattr’ command. Once immutable, it will not be possible to delete, modify, or rename the file or directory that it has been applied to. We can use the ‘lsattr’ command to list attributes on a particular file or directory to see if the ‘i’ flag is in place. A superuser can remove the immutable flag, allowing it to be removed, edited, or renamed.

Leave a Comment

vceplus-200-125    | boson-200-125    | training-cissp    | actualtests-cissp    | techexams-cissp    | gratisexams-300-075    | pearsonitcertification-210-260    | examsboost-210-260    | examsforall-210-260    | dumps4free-210-260    | reddit-210-260    | cisexams-352-001    | itexamfox-352-001    | passguaranteed-352-001    | passeasily-352-001    | freeccnastudyguide-200-120    | gocertify-200-120    | passcerty-200-120    | certifyguide-70-980    | dumpscollection-70-980    | examcollection-70-534    | cbtnuggets-210-065    | examfiles-400-051    | passitdump-400-051    | pearsonitcertification-70-462    | anderseide-70-347    | thomas-70-533    | research-1V0-605    | topix-102-400    | certdepot-EX200    | pearsonit-640-916    | itproguru-70-533    | reddit-100-105    | channel9-70-346    | anderseide-70-346    | theiia-IIA-CIA-PART3    | certificationHP-hp0-s41    | pearsonitcertification-640-916    | anderMicrosoft-70-534    | cathMicrosoft-70-462    | examcollection-cca-500    | techexams-gcih    | mslearn-70-346    | measureup-70-486    | pass4sure-hp0-s41    | iiba-640-916    | itsecurity-sscp    | cbtnuggets-300-320    | blogged-70-486    | pass4sure-IIA-CIA-PART1    | cbtnuggets-100-101    | developerhandbook-70-486    | lpicisco-101    | mylearn-1V0-605    | tomsitpro-cism    | gnosis-101    | channel9Mic-70-534    | ipass-IIA-CIA-PART1    | forcerts-70-417    | tests-sy0-401    | ipasstheciaexam-IIA-CIA-PART3    | mostcisco-300-135    | buildazure-70-533    | cloudera-cca-500    | pdf4cert-2v0-621    | f5cisco-101    | gocertify-1z0-062    | quora-640-916    | micrcosoft-70-480    | brain2pass-70-417    | examcompass-sy0-401    | global-EX200    | iassc-ICGB    | vceplus-300-115    | quizlet-810-403    | cbtnuggets-70-697    | educationOracle-1Z0-434    | channel9-70-534    | officialcerts-400-051    | examsboost-IIA-CIA-PART1    | networktut-300-135    | teststarter-300-206    | pluralsight-70-486    | coding-70-486    | freeccna-100-101    | digitaltut-300-101    | iiba-CBAP    | virtuallymikebrown-640-916    | isaca-cism    | whizlabs-pmp    | techexams-70-980    | ciscopress-300-115    | techtarget-cism    | pearsonitcertification-300-070    | testking-2v0-621    | isacaNew-cism    | simplilearn-pmi-rmp    | simplilearn-pmp    | educationOracle-1z0-809    | education-1z0-809    | teachertube-1Z0-434    | villanovau-CBAP    | quora-300-206    | certifyguide-300-208    | cbtnuggets-100-105    | flydumps-70-417    | gratisexams-1V0-605    | ituonline-1z0-062    | techexams-cas-002    | simplilearn-70-534    | pluralsight-70-697    | theiia-IIA-CIA-PART1    | itexamtips-400-051    | pearsonitcertification-EX200    | pluralsight-70-480    | learn-hp0-s42    | giac-gpen    | mindhub-102-400    | coursesmsu-CBAP    | examsforall-2v0-621    | developerhandbook-70-487    | root-EX200    | coderanch-1z0-809    | getfreedumps-1z0-062    | comptia-cas-002    | quora-1z0-809    | boson-300-135    | killtest-2v0-621    | learncia-IIA-CIA-PART3    | computer-gcih    | universitycloudera-cca-500    | itexamrun-70-410    | certificationHPv2-hp0-s41    | certskills-100-105    | skipitnow-70-417    | gocertify-sy0-401    | prep4sure-70-417    | simplilearn-cisa    |    |    |