How to Protect Files and Directories from Deleting in Linux

The chattr (change attribute) command is a powerful Linux utility that allows system administrators to set or unset specific attributes on files and directories. This tool provides an additional layer of protection against accidental deletion or modification, even when logged in as the root user. It's particularly useful for protecting critical system files, configuration files, and important data.

This article demonstrates how to use chattr to safeguard your files and directories from unauthorized or accidental deletion, providing essential security for sensitive content.

How chattr Works

The chattr command modifies file attributes at the filesystem level. The most commonly used attribute is the immutable flag (+i), which makes a file or directory completely read-only. When this flag is set, the file cannot be deleted, renamed, moved, or modified, regardless of file permissions or user privileges.

Protecting Files

To demonstrate file protection, let's use a sample file called abc.txt.

Setting File Protection

To make a file immutable and protect it from deletion, use the following command −

$ sudo chattr +i abc.txt

Now attempt to remove the file using the standard rm command −

$ rm abc.txt

The output will show that the file is protected −

rm: remove write-protected regular file 'abc.txt'?

Even if you confirm the deletion, the file will remain intact because of the immutable attribute.

Removing File Protection

To remove the immutable attribute and allow normal file operations, use the following command −

$ sudo chattr -i abc.txt

Verify that protection has been removed by attempting to delete the file −

$ rm abc.txt

The file will now be deleted without any protection warnings.

Protecting Directories

Directory protection works similarly to file protection, but requires the recursive flag to apply attributes to all contents within the directory.

Setting Directory Protection

To protect a directory named abc and all its contents, use the following command −

$ sudo chattr -R +i abc

The -R flag applies the immutable attribute recursively to the directory and all files and subdirectories within it.

Test the protection by attempting to remove the directory −

$ rm -r abc

The system will prompt with a protection warning −

rm: descend into write-protected directory 'abc'?

Removing Directory Protection

To remove protection from a directory and its contents, use −

$ sudo chattr -R -i abc

Verify the removal by deleting the directory −

$ rm -r abc

The directory will now be deleted successfully.

Additional chattr Attributes

Viewing File Attributes

To check the current attributes of a file or directory, use the lsattr command −

$ lsattr abc.txt

This displays the attributes currently set on the specified file.

Conclusion

The chattr command provides robust file and directory protection by setting filesystem-level attributes that prevent accidental deletion or modification. Using the immutable flag (+i) is an effective way to safeguard critical files and directories, offering protection beyond traditional file permissions and making it an essential tool for Linux system administration.