Hide permissions on linux ---- chattr lsattr

You can add and hide permissions to files with special requirements (such as server logs. These hidden permissions include:

Append only (a), compressed (c), no dump (d), immutable (I), data journalling (j), secure deletion (s ), no tail-merging (t), undeletable (u), no atime updates (A), synchronous directory updates (D), synchronous updates (S ), and top of directory hierarchy (T ).

Most attributes play an important role in file system security management. For details about the above attributes, refer to chattr's online help man. Note that most attributes must be applied by root.

You can use chattr to set the permission to hide an object.

[Root] # chattr -- help

Usage: chattr [-RV] [-+ = AacDdijsSu] [-v version] files...

Parameter or option description:

-R: recursive processing. All files and subdirectories in the specified directory are processed together.

-V: indicates that the detailed process has a version number.

-V: sets the file or directory version ).

+: Append parameters based on the original parameter settings.

-: Remove the parameter based on the original parameter settings.

=: Updated to the specified parameter settings.

A: The atime (access time) of A file or directory cannot be modified, which can effectively prevent I/O errors on A laptop disk.

S: Hard Disk I/O synchronization option, similar to sync.

A: append. After this parameter is set, data can only be added to the file, but cannot be deleted. This attribute is mostly used for server log file security and can only be set by root.

C: compresse: Specifies whether the file is compressed before being stored. Automatic decompression is required for reading.

D: no dump. the file cannot be the backup target of the dump program.

I: The set file cannot be deleted, renamed, or linked, and cannot be written or added. The I parameter is very helpful for security settings of the file system.

J: That is, journal. this parameter is set so that when the file system is mounted by the mount parameter: data = ordered or data = writeback, the file is first recorded (in journal) when written ). If the filesystem parameter is set to data = journal, this parameter is automatically invalid.

S: Confidential deletion of files or directories, that is, the hard disk space is all withdrawn.

U: opposite to s. When set to u, the data content still exists in the disk and can be used for undeletion.

A and I are often used in each parameter option. Option a can only be added and cannot be deleted. It is mostly used for security settings of the log system. I is a more rigorous security setting. This option can be applied only to processes with superuser (root) or CAP_LINUX_IMMUTABLE processing capability (identifier. Let's take an example:

[Root] # touch chattr_test

[Root] # chattr + I chattr_test

[Root] # rm chattr_test

Rm: remove write-protected regular empty file 'chattr _ test '? Y

Rm: cannot remove 'chattr _ test': Operation not permitted

In this case, even root itself cannot directly perform the delete operation. You must first remove the I settings before deleting them.

The online help of the chattr command details the applicability of various Parameter options and bug prompts. It is recommended that you carefully check the options when using the chattr command. Because these properties are hidden, you need to use the lsattr command to view them. The following is a brief description.

Lsattr command format:

[Root] # lsattr [-RVadlv] [files...]

Description of parameters or options:

-R: recursively lists directory and file attributes.

-V: displays the program version number.

-A: displays all file attributes, including hidden files (.), current directories (./), and upper directories (../).

-D: Only List Directory properties.

-L: (this parameter does not work currently ).

-V: displays the file or directory version.

Example:

[Root] # chattr + aij lsattr_test

[Root] # lsattr

---- Ia --- j ---./lsattr_test

 

 

You can use the stat command and the lsattr command to display the details of a file:

 

 

From: ANLJF's column