Master Linux File Attributes with chattr: Common Flags and Hidden Tricks

Common chattr Flags

A

: Atime – tells the system not to modify the file's last access time. S: Sync – forces the system to write changes to disk immediately after a write operation. a: Append Only – allows only data to be appended to the file; the file cannot be overwritten or truncated. When set on a directory, new files can be created and modified, but existing files cannot be deleted. b: Do not update the file or directory's last access time. c: Compress – stores the file or directory in a compressed form. d: Do not dump – the file or directory will be omitted from dump backups. D: Check for errors in compressed files. i: Immutable – the file cannot be modified in any way. If set on a directory, its contents cannot be created, deleted, or renamed. s: Secure deletion – overwrites the file's data blocks with zeros after deletion, making recovery impossible. u: Undelete – retains the file's data blocks after a delete request, allowing recovery. t: Enables tail‑merging on the filesystem. X: Allows direct access to the contents of a compressed file.

Typical chattr Commands

Lock a file so it cannot be deleted or modified: chattr +i /etc/passwd Append‑only mode (cannot delete, only add data): chattr +a /etc/passwd Make a file non‑deletable: chattr -d /path/to/file View file attributes (e.g., to see the i flag): lsattr /etc/passwd Unlock a file:

chattr -i /home/jiaxu/test.txt

Hiding the chattr Command

which chattr
mv /usr/bin/chattr /opt/ftl/
cd /opt/ftl/
mv chattr h   # rename to hide the command
/opt/ftl/h +i /home/jiaxu/test.txt   # use the hidden command to set the immutable flag
lsattr /home/jiaxu/test.txt   # verify the attribute

Restoring the Hidden Command

mv h /usr/bin/chattr
chattr -i /home/jiaxu/test.txt
lsattr /home/jiaxu/test.txt