Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to create a file even root user can't delete it ?

share|improve this question
While tante's answer should cover your question, one meta-comment to it: It would be much easier to answer if you added your rationale to your question. Maybe there is a work around to your problem not consisting of preventing deletion of the file(s)? – fschmitt Sep 27 '10 at 12:45
up vote 31 down vote accepted

Simple answer: You can't, root can do everything.

You can set the "i" attribute with chattr (at least if you are on ext{2,3,4}) which makes a file unchangeable but root can just unset the attribute and delete the file anyways.

More complex (and ugly hackish workaround): Put the directory you want unchangeable for root on remote server and mount it via NFS or SMB. If the server does not offer write permissions that locks out the local root account. Of course the local root account could just copy the files over locally, unmount the remote stuff, put the copy in place and change that.

You cannot lock out root from deleting your files. If you cannot trust your root to keep files intact, you are having a social problem, not a technical one.

share|improve this answer
This question is asked by an interviewer to me. I don't know the answer. I asked to him for answer. He said it possible and find solution by yourself. – Kumar Sep 27 '10 at 13:05
someday you too will be an interviewer and be able to ask nonsensical questions of your own: "can root create a file so large that he can't mv it?" (which is a lame joke based on Christian theosophy, and a terrible joke if you you aren't familiar with field) – msw Sep 27 '10 at 13:23
@msw: One could argue that it's a terrible joke even if you are familiar with the field. – Matthew Crumley Sep 27 '10 at 13:48
@matthew crumley: guilty as charged :) – msw Sep 27 '10 at 15:45
@msw: I just noticed that you even admitted it was a lame joke. And FWIW, I like (some) lame jokes so I actually liked it. This is getting pretty far off topic though :) – Matthew Crumley Sep 27 '10 at 17:08

Put it on a CD-rom! ;)

(this should be a comment but I can't do comments...)

share|improve this answer
There is a sense behind the reputation limit for comments ;-) Just a small thought-provoking impulse. no flame intended ;-) – echox Sep 27 '10 at 16:37
+1 But that would work. – Richard Holloway Sep 27 '10 at 22:44
This and the answer by @mouviciel is the only correct solution. Even the almighty @root is still bound by the rules set by the hardware. – Lie Ryan Sep 28 '10 at 8:19

Put your file on a readonly filesystem. This may be a remote FS where root is no longer root, a CD-ROM or a removable device that can be write-protected, e.g., a SD card.

share|improve this answer

Long ago I wrote a kernel patch (to 2.2.ancient) where attempting to delete a file called SELFDESTRUCT killed the calling process. This guarded against accidental "rm -rf *".

share|improve this answer
long ago and far away. How did you actually do it (commands) ? – Michael Durrant Sep 15 '15 at 10:43

You can use chattr +i to make a file immutable.

Of course a savvy user with root access could still use chattr -i to remove the immutable attribute and then delete the file, but they could undo any of the other attempts to block access listed here as well.

I would argue that chattr is the correct Unix way to do this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.