Editing a file without overwrite permission

Question

Is it possible to set permissions for file to keep it editable but without permission to overwrite?

I mean possibility to edit the file with text editor, but denying any attempt to replace the file by overwriting. The user is root. I know that it is not the common structure of unix file permission, but I am looking for a tricky approach.

I have a package of files, as some of them have been edited/customized from the original version. When updating the package with a new version, I want to replaced any untouched file, but protect the customized files (not to miss edits). Currently, I must do this manually: writing which file has been edited, not to be replaced in new update.

Answer 1

Since all packages will try to override the config file completely, you could set the file in append only mode by,

chattr +a bb

Thus you can't do remove/truncate the file, only append it.

But in that case, you will stop package manager from upgrading system.

If you just don't want the package manager to override your customized files, you could hold the package, on debian/ubuntu, you could do:

echo package-name hold | dpkg --set-selections

That way this package will not get upgraded, your files are kept.

Answer 2

It depends on what exactly "overwrite" means. If it means changing the data of an existing file, then it's not possible because the operating system has no way of distinguishing an "edit" from an "overwrite" -- they're both changing the data of the file. If it means deleting and creating a new file with the same name (or renaming a new file to this name), then this can be achieved by removing write permission from the directory containing the file. Obviously this would apply to all files in that directory though, not one specific file.

Answer 3

Firs of all, do a tar of the package's important files. Then upgrade. Once you installed the new version, untar the save in another directory, and diff the files you edited with the new-from-package ones. That way you'll see if the new files don't also have important things to be added/changed (ie, the devs may also have added modification to the files you edited, and those changes should be kept too. You can't just replace the new-from-new-package files with your old edits, without checking first if those new files don't contain new important information)

Answer 4

As root do:

chattr +i foo.txt

Then try:

vim foo.txt

change the file in vim and try to save it.

An example use case is chattr +i /etc/resolv.conf so that your pesky network-manager service doesn't overwrite it with some bum file it gets from a misconfigured home/office router.

You can undo it with:

chattr -i foo.txt

In the Linux file system model, that's the best you can do. There isn't any other solution.