System files with strict permissions

Question

Usually, when we run

ls -l

we can see such picture -rwx...- so the owner always has the full stack of permissions. And usually the owner of the system files is the root. Are there any system files where the root doesn't have all permissions, e.g. only read? If they exist, why do they have so strict permission policy even for the root?

Answer 1

Files that aren't meant to be executed don't have the x permission even for root so he doesn't accidentally execute something. Files that root should think twice before overwriting lack the w permission for root. Root can override this without changing the file's permissions, but most programs prompt before doing so. I believe read permission isn't checked at all for root.

Answer 2

There are only 3 (that I can readily think of) ways of denying root access to a file (on normal filesystems).

1. Filesystem is mounted in read-only.
2. The file is immutable (chattr +i). Root is able to change the attributes and remove the immutable flag, but this is a manual process as applications dont automatically do this. This is commonly used to prevent accidentally writing to files.
3. The file is a running executable. The kernel prevents modification of any executable which is currently running. You can unlink (rm) the file, but you cannot modify its contents.

Now there are lots of other ways of denying write access to a file when using root. Network filesystems like NFS and CIFS can deny root access if configured to do so on the server. Some other special filesystems, like mvfs from IBM Rational ClearCase, can do this as well.

However with all this said, there arent any standard files that root isnt able to write to. A distribution can set files with the immutable flag sure, but its not standard.