| Tested on | Ubuntu 25.04 (Plucky Puffin) |
|---|---|
| Package | chattr from e2fsprogs 1.47.2 |
| Applies to | ext2, ext3, and ext4 . Limited attribute support on xfs, btrfs, and tmpfs |
| Privilege | sudo or root |
| Man page | chattr(1) |
| Scope | chattr sets filesystem-level attributes on ext2, ext3, and ext4 — immutable (+i) blocks edits and deletion even for root; append-only (+a) allows only adds at the end. Pair it with lsattr to inspect flags before. |
| Related guides | Linux commands |
chattr — quick reference
Common attributes
Attributes apply on top of normal permissions. + adds, - removes, = sets exactly the flags you list.
| When to use | Command |
|---|---|
| Make a file immutable (no edit, delete, or rename) | sudo chattr +i file |
| Remove immutable flag | sudo chattr -i file |
| Append-only (writes only at end — good for logs) | sudo chattr +a file |
| Remove append-only | sudo chattr -a file |
| Set only immutable and clear other user attributes | sudo chattr =i file |
Synchronous writes to disk (+S, ext4 only — fails on tmpfs) |
sudo chattr +S file |
| Remove synchronous-updates flag | sudo chattr -S file |
Recursive and output
| When to use | Command |
|---|---|
| Apply attributes to a directory and all contents | sudo chattr -R +i directory |
| Remove attributes recursively | sudo chattr -R -i directory |
| Suppress non-fatal error messages | sudo chattr -f +a file |
Inspect with lsattr
| When to use | Command |
|---|---|
| Show attributes on one file | lsattr file |
| List attributes in a directory | lsattr |
| Include hidden names | lsattr -a directory |
| Show directory inode only (not children) | lsattr -d directory |
| Show file generation number (ext4; fails on tmpfs) | lsattr -v file |
chattr — command syntax
Synopsis from chattr --help on Ubuntu 25.04 (e2fsprogs 1.47.2):
Usage: chattr [-RVf] [-+=aAcCdDeijPsStTuFx] [-p project] [-v version] files...lsattr synopsis:
Usage: lsattr [-RVadlpv] [files...]chattr and lsattr work on ext-family filesystems. They do not replace chmod — attributes enforce behavior the kernel checks after permission bits.
chattr — command examples
All examples use paths under /tmp. Run on a filesystem that supports attributes (ext4). tmpfs /tmp on some hosts returns Operation not supported — use an ext4 path or see Troubleshooting.
Essential View attributes with lsattr
Before changing flags, see what is already set. Letters in the output map to attributes; dashes mean off.
Run the command:
echo 'chattr test content' > /tmp/attrfile.txt
lsattr /tmp/attrfile.txtSample output on tmpfs /tmp (ext4 also shows e for extents):
---------------------- /tmp/attrfile.txtrm -f /tmp/attrfile.txtEssential Set and clear immutable (+i)
Immutable files cannot be edited, deleted, or renamed — even by root — until you remove i.
Run the command:
echo 'lock me' > /tmp/attrfile.txt
sudo chattr +i /tmp/attrfile.txt
lsattr /tmp/attrfile.txt
echo 'try edit' >> /tmp/attrfile.txt 2>&1 || true
sudo chattr -i /tmp/attrfile.txt
lsattr /tmp/attrfile.txtSample output:
----i----------------- /tmp/attrfile.txt
bash: /tmp/attrfile.txt: Operation not permitted
---------------------- /tmp/attrfile.txtAlways chattr -i before legitimate maintenance.
rm -f /tmp/attrfile.txtEssential Append-only (+a) for log-style files
Append-only allows new bytes at the end but blocks overwrite, truncate, and delete.
Run the command:
echo 'line one' > /tmp/attrlog.txt
sudo chattr +a /tmp/attrlog.txt
lsattr /tmp/attrlog.txt
echo 'line two' >> /tmp/attrlog.txt
truncate -s 0 /tmp/attrlog.txt 2>&1 || true
sudo chattr -a /tmp/attrlog.txt
cat /tmp/attrlog.txtSample output:
-----a---------------- /tmp/attrlog.txt
truncate: /tmp/attrlog.txt: Operation not permitted
line one
line twoRemove +a before log rotation tools that truncate files.
rm -f /tmp/attrlog.txtCommon Recursive immutable on a directory tree
-R applies the attribute to the directory and every entry below it — use only on paths you control.
Run the command:
mkdir -p /tmp/attrdir/sub
echo child > /tmp/attrdir/sub/child.txt
sudo chattr -R +i /tmp/attrdir
lsattr -d /tmp/attrdir
lsattr /tmp/attrdir/sub/child.txt
sudo chattr -R -i /tmp/attrdirSample output:
----i----------------- /tmp/attrdir
----i----------------- /tmp/attrdir/sub/child.txtRevert with -R -i before rm -rf.
rm -rf /tmp/attrdirCommon Set exact attributes with =
= replaces the attribute set. chattr =i file keeps only i and clears other user-set flags you did not list.
Run the command:
echo x > /tmp/attrfile.txt
sudo chattr +a /tmp/attrfile.txt
sudo chattr =i /tmp/attrfile.txt
lsattr /tmp/attrfile.txt
sudo chattr -i /tmp/attrfile.txtSample output:
----i----------------- /tmp/attrfile.txta is gone — only i remains. Use = carefully on production files.
rm -f /tmp/attrfile.txtAdvanced Force-clear immutable with -f
When +i blocks chattr -i, -f can clear the flag on tmpfs without a separate error path.
Run the command:
echo v > /tmp/attrfile.txt
sudo chattr +i /tmp/attrfile.txt
sudo chattr -f -i /tmp/attrfile.txt
lsattr /tmp/attrfile.txtSample output:
---------------------- /tmp/attrfile.txtOn ext4, chattr +S sets synchronous writes — that flag returns Operation not supported on tmpfs /tmp.
rm -f /tmp/attrfile.txtAdvanced lsattr -a and -d on a directory
-a lists hidden entries; -d shows only the directory inode. Skip lsattr -v on tmpfs — it needs ext4.
Run the command:
mkdir -p /tmp/attrdir
echo hidden > /tmp/attrdir/.secret
lsattr -a /tmp/attrdir | head -3
lsattr -d /tmp/attrdirSample output:
---------------------- /tmp/attrdir/.secret
---------------------- /tmp/attrdirrm -rf /tmp/attrdirchattr — when to use / when not
| Use chattr when | Use something else when |
|---|---|
|
|
chattr vs chmod
| chattr | chmod | |
|---|---|---|
| Layer | Filesystem extended attributes | Permission bits (rwx) |
| Blocks root delete | Yes (+i) |
No |
| Typical use | Hardening, append-only logs | Everyday access control |
Use both: chmod for who can access; chattr for behaviors chmod cannot express.
chattr — interview corner
What is chattr used for?
chattr changes extended file attributes on ext-family filesystems. Flags like i (immutable) and a (append-only) are enforced by the kernel below normal permission bits — so root cannot delete an immutable file without clearing i first.
lsattr reads the same flags.
A strong answer is:
"chattr sets ext filesystem attributes — immutable stops edits and deletion, append-only allows adds at EOF. lsattr shows current flags."
Can root modify an immutable file?
Not while +i is set. Root must run chattr -i first. That is why immutable flags are used to guard config and binaries against mistakes and some classes of compromise.
A strong answer is:
"Immutable blocks even root until chattr -i — it's filesystem-level, not just UID checks."
When would you use append-only (+a)?
For log and audit files where writers should only add lines, not rewrite or truncate history. Rotation tools that truncate must clear +a first.
A strong answer is:
"+a is for logs — append allowed, overwrite and truncate blocked until the attribute is removed."
Does chattr work on every Linux filesystem?
Check mount-point usage and filesystem types with df; the df and du covers -h, -T, and filtering pseudo-filesystems.
No. It is reliable on ext2, ext3, and ext4 (e2fsprogs). tmpfs, many btrfs mounts, and some xfs setups return Operation not supported or ignore flags. Check with df -T on the file path.
A strong answer is:
"chattr is for ext — tmpfs and some other FS types don't support it; I verify with df -T before hardening."
How is chattr different from chmod?
chmod sets rwx for user/group/other. chattr sets filesystem attributes (immutable, append-only, sync, …) that chmod cannot express.
A strong answer is:
"chmod is permissions; chattr is ext attributes like immutable — complementary, not replacements."
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
Operation not supported |
Path on tmpfs, nfs, or unsupported FS | Use ext4 path; df -T /path |
Operation not permitted on edit |
+i or +a set |
sudo chattr -i / -a |
| Cannot delete file | Immutable | sudo chattr -i file then rm |
| Attribute set but no effect | FS ignores flag | Confirm with lsattr; check filesystem type |
| Logrotate fails | +a or +i on log |
Remove attribute before rotation |
+S fails on /tmp |
tmpfs does not support sync flag | Use ext4 paths for +S demos |
lsattr -v ioctl error |
tmpfs lacks generation ioctl | Run -v on ext4 files only |
Locked yourself out of /etc file |
+i on live config |
sudo chattr -i from recovery |
References
- lsattr(1) man page (Ubuntu noble)
