Lesson 3.62: Immutable and append-only files
Besides permissions, ext4 and other Linux file systems keep attributes on every file. Two matter for security: i (immutable: nobody, not even root, may change, rename or delete the file) and a (append-only: data may only be added at the end). Attackers set i on their cron job and SSH key so that a hurried admin's rm fails and they assume the file is special. Defenders set a on audit logs. In the lab rm fails as root; you find why, sweep for other locked files, clean up and then use append-only for the incident log.
15 min
You will learn to
- Explain the i and a file attributes
- Read attributes with lsattr and change them with chattr
- Sweep directories for immutable and append-only files
- Remove attacker persistence protected by +i
- Protect a log with +a
Key terms
- File attributes
- Flags the file system keeps per file, separate from permissions and ownership.
- Immutable (i)
- No one may write, rename, delete or link the file, root included.
- Append-only (a)
- Data may only be added at the end; overwrite, truncate and delete fail.
- CAP_LINUX_IMMUTABLE
- The capability needed to set or clear i and a.
- Operation not permitted
- EPERM: the operation is forbidden regardless of permissions (often an attribute or a capability).
← Growing a volume with LVM · All lessons · Boot loader and kernel command line →