Linux Files cannot be modified or edited by the root user.

Recently, a company's server was maliciously added some timer tasks to the crond configuration file "/var/spool/cron/root, in this case, you only need to simply use the crontab-e command to remove the malicious task. However, after the modification, I found that no matter how hard I try to save it, directly modifying the file "/var/spool/cron/root" won't work either. I have a hard time thinking about the power of this root user who has the highest power.PerformChange and delete. Later, after a friend of senior Linux clicked it, he realized that in addition to the permission Control for reading and writing, the file also had lower-level file attributes, here, the two commands used to view and change the file properties are lsattr and chattr.

Use lsattr/var/spool/cron/root to check whether the file has been added with the SIA attribute: s --- Ia -------/var/spool/cron/root. Then use: chattr-ISA/var/spool/cron/root removes these three attributes, and the file can be modified.To remove the malicious task.