Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How to create a file even root user can't delete it ?

share|improve this question
9  
While tante's answer should cover your question, one meta-comment to it: It would be much easier to answer if you added your rationale to your question. Maybe there is a work around to your problem not consisting of preventing deletion of the file(s)? –  fschmitt Sep 27 '10 at 12:45
add comment

4 Answers

up vote 26 down vote accepted

Simple answer: You can't, root can do everything.

You can set the "i" attribute with chattr (at least if you are on ext{2,3,4}) which makes a file unchangeable but root can just unset the attribute and delete the file anyways.

More complex (and ugly hackish workaround): Put the directory you want unchangeable for root on remote server and mount it via NFS or SMB. If the server does not offer write permissions that locks out the local root account. Of course the local root account could just copy the files over locally, unmount the remote stuff, put the copy in place and change that.

You cannot lock out root from deleting your files. If you cannot trust your root to keep files intact, you are having a social problem, not a technical one.

share|improve this answer
    
This question is asked by an interviewer to me. I don't know the answer. I asked to him for answer. He said it possible and find solution by yourself. –  Kumar Sep 27 '10 at 13:05
8  
someday you too will be an interviewer and be able to ask nonsensical questions of your own: "can root create a file so large that he can't mv it?" (which is a lame joke based on Christian theosophy, and a terrible joke if you you aren't familiar with field) –  msw Sep 27 '10 at 13:23
2  
@msw: One could argue that it's a terrible joke even if you are familiar with the field. –  Matthew Crumley Sep 27 '10 at 13:48
    
@matthew crumley: guilty as charged :) –  msw Sep 27 '10 at 15:45
    
@msw: I just noticed that you even admitted it was a lame joke. And FWIW, I like (some) lame jokes so I actually liked it. This is getting pretty far off topic though :) –  Matthew Crumley Sep 27 '10 at 17:08
add comment

Put it on a CD-rom! ;)

(this should be a comment but I can't do comments...)

share|improve this answer
    
There is a sense behind the reputation limit for comments ;-) Just a small thought-provoking impulse. no flame intended ;-) –  echox Sep 27 '10 at 16:37
5  
+1 But that would work. –  Richard Holloway Sep 27 '10 at 22:44
1  
This and the answer by @mouviciel is the only correct solution. Even the almighty @root is still bound by the rules set by the hardware. –  Lie Ryan Sep 28 '10 at 8:19
add comment

Put your file on a readonly filesystem. This may be a remote FS where root is no longer root, a CD-ROM or a removable device that can be write-protected, e.g., a SD card.

share|improve this answer
add comment

Long ago I wrote a kernel patch (to 2.2.ancient) where attempting to delete a file called SELFDESTRUCT killed the calling process. This guarded against accidental "rm -rf *".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.