chattr / lsattr
Overview
chattr sets ext file attributes (immutable, append-only, no-dump, etc.); lsattr lists them. These are separate from mode bits (chmod) and ACLs (setfacl). Classic operator uses: make a file immutable against accidental deletion, mark logs append-only, or exclude paths from dump. Attributes are filesystem-specific — full support is strongest on ext2/3/4; other FS may ignore or partially support flags.
Syntax
lsattr [options] [file...]
chattr [options] mode file...mode is +-= followed by attribute letters, e.g. +i, -a, =i.
Common Options
lsattr
| Option | Description |
|---|---|
-a |
Include dotfiles |
-d |
List directories themselves, not contents |
-R |
Recursive |
-v |
Version/generation if available |
-l |
Long option names for flags (newer e2fsprogs) |
chattr
| Option | Description |
|---|---|
+X / -X / =X |
Add / remove / set exactly attribute X |
-R |
Recursive |
-V |
Verbose |
-f |
Suppress most errors |
-v version |
Set file version/generation |
Important attribute letters
| Flag | Meaning (typical) |
|---|---|
i |
Immutable — cannot modify, delete, rename, link (root must clear first) |
a |
Append-only — open only in append mode for writes |
A |
No atime updates |
c |
Compressed (FS-dependent; often no-op on plain ext4) |
d |
No dump |
e |
Extent format (usually set by FS; don’t clear casually) |
j |
Data journaling (ext3/4 specifics) |
s |
Secure deletion (often not honored as expected) |
S |
Synchronous updates |
u |
Undeletable (legacy; rarely useful) |
Most operators only need i and a.
Safety
chattr +ias root can lock out application writes until you remember to-i— document it.- Recursive
+ion a tree can break package upgrades and log rotation. - Attributes are not a substitute for backups or proper permissions.
- On non-ext filesystems, commands may succeed partially or reject flags — verify with
lsattrand test writes. - Immutable system files can block
apt/dpkg— clear before upgrades.
Examples with Explanations
List attributes
lsattr file.txt
lsattr -d /etc/hostname
lsattr -R /var/log/myapp 2>/dev/null | headA line like ----i---------e------- file means immutable (i) plus extent (e).
Make a file immutable
sudo chattr +i /etc/myapp/critical.conf
lsattr /etc/myapp/critical.conf
# even root cannot overwrite until:
sudo chattr -i /etc/myapp/critical.confUseful against accidental rm/overwrite; not a strong security boundary against a malicious root.
Append-only log
sudo chattr +a /var/log/myapp/audit.log
# app can append; cannot truncate/overwrite in place
# to rotate: clear a, rotate, restore a
sudo chattr -a /var/log/myapp/audit.logCoordinate with logrotate (endscript hooks) if you use +a.
Clear / set exactly
sudo chattr -i -a file
sudo chattr = file # clear all settable attrs (careful)Protect a directory entry (directory itself)
sudo chattr +i /important-dir
# prevents adding/removing entries in some cases; know the semantics before using
sudo chattr -i /important-dirTest on non-production paths — immutable directories surprise people.
No-dump flag
sudo chattr +d /var/cache/bulk
lsattr -d /var/cache/bulkHints to dump(8) to skip; modern backup tools may ignore this flag unless coded for it.
Combine with permissions
sudo chown root:root /etc/myapp/critical.conf
sudo chmod 644 /etc/myapp/critical.conf
sudo chattr +i /etc/myapp/critical.confMode bits control who can read; i resists modification/deletion.
Notes
- Requires appropriate privileges (usually root) for security-sensitive flags like
ianda. e(extents) is normal on modern ext4 files — don’t treat it as a problem.- XFS has
chattr/lsattrcompatibility for some flags but also its ownxfs_io/xfs_admintooling. - Backups: confirm your backup agent preserves attributes if you rely on them after restore.
- Containers: attributes on bind-mounted host ext volumes work; the container root may still need CAP_LINUX_IMMUTABLE-related capabilities for
+i.
Additional Resources
man chattr,man lsattrman 1 chattrattribute table