Mastering the Linux chattr Command: A Beginner’s Guide with 5 Practical Examples

The chattr command in Linux is a powerful utility that allows users to change file attributes on a filesystem. This command enhances file control by setting attributes that modify file behaviors in ways beyond standard permissions. For instance, using chattr, you can make a file immutable with the “+i” attribute, preventing it from being modified, deleted, or renamed, even by the root user. Other attributes include “+a”, which permits a file to be opened only in append mode, and “+u”, which ensures file contents are saved for undeletion. These attributes are particularly useful for securing critical system files, preventing accidental deletions, and managing files with greater precision. The command requires superuser privileges and is commonly used by system administrators to enhance the security and integrity of important files within the Linux filesystem.

In environments where multiple users access a common group of files, there is a risk of accidental deletion or editing of important files, which is undesirable for system administrators.

This tutorial will demonstrate how to use this tool with clear examples. These examples have been tested on Ubuntu 24.04 LTS and Debian 12.

Understanding the Linux chattr Command

The chattr command is used to modify file attributes on a Linux file system. Here is the basic syntax:

chattr [ -RVf ] [ -v version ] [ mode ] files...

According to the manual page:

       chattr changes the file attributes on a Linux file system.
The format of a symbolic mode is +-=[aAcCdDeijsStTu].

The  operator  '+'  causes  the  selected attributes to be added to the
existing attributes of the files; '-' causes them to  be  removed;  and
'=' causes them to be the only attributes that the files have.

The  letters  'aAcCdDeijsStTu' select the new attributes for the files:
append only (a), no atime updates (A), compressed (c), no copy on write
(C), no dump (d), synchronous directory updates (D), extent format (e),
immutable (i), data journalling (j), secure deletion  (s),  synchronous
updates  (S),  no tail-merging (t), top of directory hierarchy (T), and
undeletable (u).

The following attributes are read-only, and may be listed by  lsattr(1)
but  not  modified  by  chattr:  compression  error (E), huge file (h),
indexed directory (I), inline data (N), compression raw access (X), and
compressed dirty file (Z).

Not  all  flags  are supported or utilized by all filesystems; refer to
filesystem-specific man pages such as btrfs(5), ext4(5), and xfs(5) for
more filesystem-specific details.

Here are some Q&A-styled examples illustrating how the chattr command works:

Q1. How to Use the chattr Command?

To make a file read-only, run the chattr command with the +i option and the filename as an argument.

For example:

chattr +i test.txt

The following screenshot shows that no operations were successful on the file once it became read-only using chattr.

Note: As observed, you need to have root privileges to use the chattr command.

Q2. How to Remove the Read-Only Restriction Imposed by chattr?

This is simple – use the -i option instead of +i. For example:

chattr -i test.txt

As you can see, the read-only restriction is removed using the -i option.

Q3. How to Provide Append-Only Permission to a File?

To allow append-only access to a file, use the +a option, enabling new data addition while restricting modification or deletion of existing data.

chattr +a test.txt

We could append to the file now but couldn’t edit existing information or delete the file. To reverse this behavior, use the -a option.

chattr -a test.txt

Q4. How to Apply a Restriction Using chattr to All Files in a Directory?

To apply attributes recursively to directories and their contents, use the -R flag. For example, to make all files inside the test-dir directory read-only, use the following command:

chattr -R +i ./test-dir/

The following screenshot confirms that the read-only restriction was successfully applied to all files in the directory.

Q5. How to Check chattr Attributes Applied on Files?

To verify if a chattr attribute was applied, use the lsattr command.

lsattr [FILENAME]

The screenshot below shows the lsattr output clearly indicating that the ‘i’ attribute was applied to all files in the directory.

Here’s the output after using the -i option to confirm the removal of attributes.

As demonstrated, the read-only attribute was successfully removed from all files.

Conclusion

The chattr command is an essential tool for system admins or anyone managing users on a Linux machine. Mastering this command can save you from many potential issues. This article provides a foundational understanding of chattr. Practice the examples discussed and, for more information, refer to the tool’s man page.

FAQ

What is the primary purpose of the chattr command?

The chattr command is used to modify file attributes on a Linux file system, enabling enhanced control over file operations beyond standard permissions.

Do I need root privileges to use the chattr command?

Yes, you need to have superuser privileges to use the chattr command effectively, as it involves modifying critical file attributes.

Can I use chattr on directories?

Yes, you can use chattr with the -R option to apply attributes recursively to directories and their contents.

How can I verify the attributes applied by chattr?

Use the lsattr command to view the attributes applied to files and directories by chattr.