Chattr and lsattr commands in Linux

Excerpt from: http://www.ha97.com/5172.html

PS: Sometimes you find that you cannot modify a file with root permissions, most of all because you have locked the file with the chattr command. The chattr command is very useful, some of which are supported by the Linux kernel version, but the majority of Linux systems running today are more than 2.6 cores. Modifying a property with the chattr command can improve the security of the system, but it is not suitable for all directories. The CHATTR command cannot protect/,/dev,/tmp,/var directories. The lsattr command is a file property that displays the Chattr command settings.

These two commands are used to view and change the file, directory properties, compared to chmod this command, chmod just change the file read and write, execute permissions, the more underlying property control is changed by Chattr.

chattr command usage: chattr [-RVF] [-v version] [mode] files ...

-R 递归处理，将指定目录下的所有文件及子目录一并处理。 

-V 显示指令执行过程。
-v<版本编号> 设置文件或目录版本。

Most crucially, in the [mode] section, the [mode] section is composed of +-= and [Asacddiijsttu] characters, which are used to control the file
Property.  

+ ：在原有参数设定基础上，追加参数。
- ：在原有参数设定基础上，移除参数。
= ：更新为指定参数设定。
A：文件或目录的 atime (access time)不可被修改(modified), 可以有效预防例如手提电脑磁盘I/O错误的发生。
S：硬盘I/O同步选项，功能类似sync。
a：即append，设定该参数后，只能向文件中添加数据，而不能删除，多用于服务器日志文件安全，只有root才能设定这个属性。
c：即compresse，设定文件是否经压缩后再存储。读取时需要经过自动解压操作。
d：即no dump，设定文件不能成为dump程序的备份目标。
i：设定文件不能被删除、改名、设定链接关系，同时不能写入或新增内容。i参数对于文件 系统的安全设置有很大帮助。
j：即journal，设定此参数使得当通过mount参数：data=ordered 或者 data=writeback 挂 载的文件系统，文件在写入时会先被记录(在journal中)。如果filesystem被设定参数为 data=journal，则该参数自动失效。
s：保密性地删除文件或目录，即硬盘空间被全部收回。
u：与s相反，当设定为u时，数据内容其实还存在磁盘中，可以用于undeletion。
各参数选项中常用到的是a和i。a选项强制只可添加不可删除，多用于日志系统的安全设定。而i是更为严格的安全设定，只有superuser (root) 或具有CAP_LINUX_IMMUTABLE处理能力（标识）的进程能够施加该选项。


Application Examples:

1. Use the chattr command to prevent a key file in the system from being modified:
# chattr +i /etc/resolv.conf

And then use mv/etc/resolv.conf and other commands to the file, are to get operation not permitted results. Vim will be prompted to W10:Warning:Changing a readonly file error when editing it. To modify this file, I will remove the I attribute: chattr-i/etc/resolv.conf

# lsattr/etc/resolv.conf
The following properties are displayed
----i-------- /etc/resolv.conf

2, let a file can only append data to the inside, but can not be deleted, applicable to various log files:
# chattr +a /var/log/messages

3, Chattr-r-V 1 Test, 1 is version information test is the file name

Chattr and lsattr commands in Linux