Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

what does the a in chattr +ia <filename> do? and why would you add the a in combination with the i? note: I know the i is for immutable

share|improve this question
up vote 4 down vote accepted
  The  letters  `acdeijstuADST'  select the new attributes for the files:
  append only (a), compressed  (c),  no  dump  (d),  extent  format  (e),
  immutable (i), data journalling (j), secure deletion (s), no tail-merg‐
  ing (t), undeletable (u), no atime updates (A),  synchronous  directory
  updates  (D),  synchronous  updates (S), and top of directory hierarchy

from the manpage for chattr

Files with this flag will fail to be opened for writing. This also blocks certain potentially destructive system calls such as truncate() or unlink().

$ touch foo
$ chattr +a foo
$ python
> file("foo", "w") #attempt to open for writing
[Errno 1] Operation not permitted: 'foo'
> quit()
$ truncate foo --size 0
truncate: cannot open `foo' for writing: Operation not permitted
$ echo "Appending works fine." >> foo
$ cat foo
Appending works fine.
$ rm foo
rm: cannot remove `foo': Operation not permitted
$ chattr -a foo
$ rm foo

This option is designed for log files.

share|improve this answer
but why would you do immutable and append only? immutable kind of prevents any writing... (we do this at work when locking sites for TOS violations and I don't understand why the a) – xenoterracide Oct 30 '10 at 13:03
@xeno that's a good question. At first analysis +a adds nothing that +i doesn't do (except paranoia); I'd check the source code of your kernel to be extra sure. – badp Oct 30 '10 at 13:15
@xenoterracide: I don't see much point. It could be belt and braces, in case someone removes the i (but someone who wants to and knows how do remove the immutable attribute would know about the append-only attribute anyway). – Gilles Oct 30 '10 at 13:16
"belt and braces" in English means "belt and suspenders" in American for our international readers. – msw Oct 30 '10 at 16:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.