Command to hide the permission of the Centos chattr lsattr File System

You can use chattr to set the permission to hide an object. Use lsattr to display the hidden permissions of an object. Chattr [+-=] [ASacdistu] [file or directory name]
Parameter description:
+-=: "+" (ADD), "-" (reduce), and "=" (SET) respectively.
A: When attribute A is set, the access time of this file (or directory) atime (access) cannot be modified, this can avoid disk I/O errors that may occur on a laptop;
S: This function is similar to sync. It is used to synchronize data into the disk, which can effectively avoid data loss;
A: After setting a, this file can only add data but cannot be deleted. Only the root user can set this attribute;
C: After this attribute is set, the file will be automatically compressed and automatically decompressed during reading. However, it is compressed during storage (useful for large files );
D: When the dump (Backup) program is executed, setting the d attribute will enable the file (or directory) to be dump;
I: This parameter prevents a file from being deleted, renamed, set links, and written to data, which is of great benefit to system security.
J: When the ext3 file system format is used, setting the j attribute will record the file in the log before writing, but when the filesystem parameter is set to data = journalled, this attribute is invalid because logs have been set.
S: when the file sets the s parameter, it will be completely removed from the hard disk space.
U: opposite to s. When the u configuration file is used, the data content can still exist in the disk and can be used to cancel deletion.

Example:
Chattr + I/etc/shadow // the file cannot be changed.
Chattr-I/etc/shadow // unbind this attribute
This command is important, especially in terms of system security. Because these properties are hidden, you need to use lsattr to view these properties.

Lsattr [-aR]
Parameter description:
-A: displays the properties of hidden files.
-R: displays data in subdirectories.
J: when the file system format ext3 is used, setting the j attribute will record the file in journal before writing!
However, when the filesystem parameter is set to data = journalled, this attribute is invalid because the log has been set!
If a file is set with the 'J' attribute, all its data is written to the ext3 file system log before being written to the file itself, if the "data = ordered" or "data = writeback" option is used for mounting the file system. When the file system uses the "data = journal" option for mounting, all file data has logged, so this attribute does not work.
This attribute can be set and deleted only by a super user or a process with the CAP_SYS_RESOURCE capability.

The chattr command was found by accident. At that time, I found that I could not delete a file. No matter what method I used or what users I used, I could not delete it. The prompt is as follows:
Rm: cannot remove 'chattr. man': Operation not permitted

Later, I learned that chattr was a ghost. Today, I read the "Advanced Bash-ScriptingGuide" book and mentioned the chattr command, and gave some parameters that I have never seen before. Therefore, man has a chattr and there are still many parameters, translation is an intensive explanation of commands, so I will try to translate them.

Name:
Chattr-change the file attributes on the EXT2 File System (EXT3 is also suitable, note)

Abstract:
Chattr [-RV] [-v version] [mode] files...

Description:
Chattr changes the attributes of a file on the EXT2 file system.

The parameter symbol format is +-= [ASacDdIijsTtu].

The '+' operator adds the selected attribute to the specified file. '-' indicates that the attribute is deleted;
'=' Indicates that only the selected attributes are set for the file (all previously set attributes are removed. Note)

The 'acdijsuadst' letter represents the following attributes:
Append only (a), compress (c), do not dump (d), do not change (I), data log (j), secure delete (s ), non-tail Merge (t), cannot be deleted (u), do not update atime (A), synchronize directory Update (D), synchronously Update (S), and top of directoryhierarchy (T ).

Option:
-R recursively changes the contents of directories and directories. the symbolic links do not enter after recursion.

-V redundant command output and program version Printing

-V version
Set the file version (generation) Number

Attribute explanation:
When accessing A file with the 'A' attribute set, the atime record is not modified. This can avoid a large number of disk I/O operations on the notebook (specifically, the notebook is to consider power saving? Note by the translator ).

If the 'A' attribute is set in the file, data can only be appended. This attribute can be set and deleted only by a super user or a process with the CAP_LINUX_IMMUTABLE capability.

If the 'C' attribute is set for the file, the file will be automatically compressed during write operations and automatically decompressed during reading.
Compress data before storing it to a disk.

If the 'D' attribute is set for a directory, any changes will be synchronized to the disk. This is equivalent to the dirsync option in the mount command: Synchronize the directory.

If the 'D' attribute is set for a file, it will not be backed up during the dump (8) operation (without dumping or modifying the file, note by the translator)

The 'E' attribute is currently an experimental compression option used to mark files with errors. Currently, it cannot be set or reset using chattr, although it can be displayed using the lsattr command.

The 'I property is used in the htree (htree) code to mark directories that use the hash number to hide the index. Currently, it cannot be set or reset using chattr, although it can be displayed using the lsattr command.

If an object is set with the 'I attribute, the object cannot be modified, deleted, renamed, linked, or written to the object. This attribute can be set and deleted only by a super user or a process with the CAP_LINUX_IMMUTABLE capability.


If a file is set with the 'J' attribute, all its data is written to the ext3 file system log before being written to the file itself, if the "data = ordered" or "data = writeback" option is used for mounting the file system. When the file system uses the "data = journal" option for mounting, all file data has logged, so this attribute does not work. This attribute can be set and deleted only by a super user or a process with the CAP_SYS_RESOURCE capability.

When a file with the 's' attribute set is deleted, all the blocks on its disk will be filled with 0, which is a security attribute.

When a file with the 's' attribute set is modified, it is synchronized to the disk. It is equivalent to the 'sync' option of the mount command.

If a directory is set with the 'T' attribute, it is regarded as the top directory of the directory structure for Orlov block allocation (used in kernel 2.5.46 or later versions)

If a file is set with the 'T' attribute, when it is merged with other files, there will be no part of the end of the file (used by the file system that supports tail merging ).
This is required for some programs, such as LILO, which directly reads the file system, but he does not understand the combination of files at the end.
Idea: At the time of writing this document, ext2 and ext3 do not support tail-merging)

If the file is set with the 'U' attribute, after the file is deleted, the content of the file can be restored.
. It allows the user to ask about the restoration and deletion method. (You do not know how to restore or delete a file)

The 'X' attribute is an experimental compression patch used to mark a raw compressed file that can be accessed directly. Currently, it cannot be set or reset using chattr, although it can be displayed using the lsattr command.

The 'Z' attribute is an experimental compression patch used to mark a dirty compressed file. Currently, it cannot be set or reset using chattr, although it can be displayed using the lsattr command.

[root@roth-01 ~]# chattr +j /mnt/gfs2/gfs2_dir/newfile [root@roth-01 ~]# lsattr /mnt/gfs2/gfs2_dir ---------j--- /mnt/gfs2/gfs2_dir/newfile 

[root@roth-01 ~]# chattr -j /mnt/gfs2/gfs2_dir/newfile [root@roth-01 ~]# lsattr /mnt/gfs2/gfs2_dir ------------- /mnt/gfs2/gfs2_dir/newfile 

[root@roth-01 ~]# chattr -j /mnt/gfs2/gfs2_dir [root@roth-01 ~]# lsattr /mnt/gfs2 ---------j--- /mnt/gfs2/gfs2_dir [root@roth-01 ~]# touch /mnt/gfs2/gfs2_dir/newfile [root@roth-01 ~]# lsattr /mnt/gfs2/gfs2_dir ---------j--- /mnt/gfs2/gfs2_dir/newfile

http://docs.redhat.com/docs/zh-CN/Red_Hat_Enterprise_Linux/5/html/Global_File_System_2/s1-manage-data-journal.html

4. Change the following file permissions so that no one has the permission to change the account: chattr + I/etc/passwd chattr + I/etc/shadow chattr + I/etc/group chattr + I/etc/gshadow