Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

While logged in, I can do the following:

mkdir foo
touch foo/bar
chmod 400 foo/bar 
chmod 500 foo

Then I can open vim (not as root), edit bar, force a write with w!, and the file is modified!

How can I make the operating system disallow any file modification?

share|improve this question
2  
I believe under the hood, vim is actually changing the permissions and then putting it back. –  jordanm Mar 10 '13 at 22:15
    
Are you not running as root? –  Alvin Wong Mar 11 '13 at 1:47
    
Alvin, I do this as a non-root user. I have edited the post to clarify. –  user2141130 Mar 11 '13 at 4:27

2 Answers 2

up vote 27 down vote accepted

You can set the "immutable" attribute with most filesystems in Linux.

chattr +i foo/bar

To remove the immutable attribute, you use - instead of +:

chattr -i foo/bar

To see the current attributes for a file, you can use lsattr:

lsattr foo/bar

The chattr(1) manpage provides a description of all the available attributes. Here is the description for i:

   A  file with the `i' attribute cannot be modified: it cannot be deleted
   or renamed, no link can be created to this file  and  no  data  can  be
   written  to  the  file.  Only the superuser or a process possessing the
   CAP_LINUX_IMMUTABLE capability can set or clear this attribute.
share|improve this answer
2  
On Linux, that immutable flag is available on many file systems not just ext2/3/4 (at least btrfs, hfsplus, jfs, nilfs2, xfs, ocfs2, ubifs, gfs2, reiserfs AFAICT from a quick look through the code) –  Stéphane Chazelas Mar 10 '13 at 23:02
    
@StephaneChazelas I saw the chattr command was part of e2fsprogs package on my system. That is why I made that statement. I have updated the answer based on your comment. –  jordanm Mar 10 '13 at 23:17
    
Thank you jordanm, that is what I was looking for. –  user2141130 Mar 11 '13 at 4:24

You can:

  1. Change the file owner to root or a dummy newly created user
  2. Keep the correct group.
  3. Use chmod 440 to allow reading by group (which is you).

If the correct user is not the only one in this group, you should create a new group and add only him in it, and use this group for it. However, you are not the owner of the file, therefore your vi cannot change the file owner.

share|improve this answer
2  
If you can write to the parent directory, then vim can delete the file and create a new one (and it's what it does when you do :w!). vim doesn't go as far as changing the permissions of the directory temporarily though. So keeping the directory non-writable should be safe. –  Stéphane Chazelas Mar 10 '13 at 23:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.