Go Chattr and lsattr commands in Linux

Transferred from: http://www.cnblogs.com/yangxia-test/archive/2013/05/24/3096410.html

These two commands are used to view and change the file, directory properties, compared to chmod this command,chmod just change the file read and write, execute permissions, the more underlying property control is changed by Chattr.

Chattr Command usage: chattr [-RVF] [-v version] [mode] files ...
Most crucially in the [mode] section, the [mode] section is composed of +-= and [Asacddiijsttu] characters, which are used to control the file's
property.

+: Append parameters based on the original parameter setting.
-: Removes the parameter based on the original parameter setting.
=: Update to the specified parameter setting.
A: Atime (Access time) of a file or directory cannot be modified (modified), which can effectively prevent the occurrence of disk I/O errors such as laptops.
S: HDD I/O sync option, similar to sync.
A: Append, after setting this parameter, can only add data to the file, not delete, more for the server log file security, only root can set this property.
C: Compresse, sets whether the file is compressed and then stored. An automatic decompression operation is required for reading.
D: No dump, the settings file cannot be the backup target of the dump program.
I: The settings file cannot be deleted, renamed, linked, and cannot be written or added. The I parameter is useful for file system security settings.
J: Journal, which sets this parameter so that when the file system is mounted via the Mount parameter: data=ordered or Data=writeback, the file is recorded (in journal) when it is written. If the filesystem parameter is set to Data=journal, the parameter is automatically invalidated.
S: The file or directory is deleted confidentially, that is, the hard disk space is fully recovered.
U: In contrast to S, when set to U, the data content actually exists in the disk and can be used for undeletion. A and I are commonly used in the
parameter options. The A option enforces that only non-removable, multi-log system security settings can be added. While I is a more stringent security setting, only superuser (root) or processes with cap_linux_immutable processing power (identity) can apply this option.


Application Examples:

1. Use the chattr command to prevent a key file in the system from being modified:
# chattr +i /etc/resolv.conf

And then use mv/etc/resolv.conf and other commands to the file, are to get operation not permitted results. Vim will be prompted to W10:Warning:Changing a readonly file error when editing it. To modify this file, I will remove the I attribute: chattr-i/etc/resolv.conf

# Lsattr/etc/resolv.conf
The following properties are displayed
----i-------- /etc/resolv.conf

2, let a file can only append data to the inside, but can not be deleted, applicable to various log files:
# chattr +a /var/log/messages

Change the root password for Linux: passwd:authentication token manipulation Error

Specific examples:
As shown below:
[Email protected] ~]# passwd root
Changing password for user root.
New UNIX Password:
Retype new UNIX Password:
sorry, passwords do not match
new Unix Password:
retype New unix Password:
passwd:authentication token manipulation Error

modified as follows:
Span style= "color: #000000; font-size:12px; " >[[email protected] ~]# chattr-i/etc/passwd
[[email  Protected] ~]# Chattr-i/etc/shadow
Then you can change the root password.

after modifying, execute the
[[email protected] ~]# chattr +i/etc/shadow

[chattr and lsattr commands for]linux