Re: Root can't delete files

From: Jason Kohles (email@jasonkohles.com)
Date: 10/11/01


Date: Thu, 11 Oct 2001 13:53:14 -0400
From: Jason Kohles <email@jasonkohles.com>
To: focus-linux@securityfocus.com
Subject: Re: Root can't delete files
Message-ID: <20011011135314.A18552@mediabang.com>

On Thu, Oct 11, 2001 at 01:09:54AM +0000, xsdg wrote:
>
> Also, to clear up any confusion, the immutable flag only prevents file contents
> from being _removed_. The files can still be appended to. If you use the
> immutable attribute on your logs, you'll probably have to do something to
> logrotate to get it to work correctly...
>
Immutable means immutable, an immutable file cannot be changed (including
appended), there is an 'append only' flag which give the behavior you
describe.

From chattr(1):

       A file with the `a' attribute set can only be open in
       append mode for writing. Only the superuser can set or
       clear this attribute.

       A file with the `i' attribute cannot be modified: it can­
       not be deleted or renamed, no link can be created to this
       file and no data can be written to the file. Only the
       superuser can set or clear this attribute.

-- 
Jason S Kohles
email@jasonkohles.com          http://www.jasonkohles.com/



Relevant Pages

  • Re: My Debian box cant connect Internet
    ... > It's very odd that you can't change this file as root. ... > know of that would cause this is if the immutable flag is set. ... > Changing the immutable flag is done with the chattr command. ...
    (Debian-User)
  • Re: My Debian box cant connect Internet
    ... It's very odd that you can't change this file as root. ... As you don't see an "i" that means the immutable flag is not set, ... Changing the immutable flag is done with the chattr command. ...
    (Debian-User)
  • Re: aide or tripwire
    ... > Which is essentially useless. ... If the attacker gets root they can unset the ... > immutable flag and muck around with it. ... using the kernel capabilities ...
    (Focus-Linux)
  • Re: Root cant delete files
    ... > using the mode +i even root can't change didly on a system. ... that has immutable flag set), so one should mark it for removal in the ... /etc/lids/lids.cap file when using LIDS. ...
    (Focus-Linux)
  • Re: Root access
    ... > immutable flag. ... Setup sudo to allow users to chattr, in some places, this should ... prevent everyone from accidently deleting a file, of course root ...
    (comp.os.linux.security)