How do I make a file NOT modifiable?

Question

While logged in, I can do the following:

mkdir foo
touch foo/bar
chmod 400 foo/bar 
chmod 500 foo

Then I can open vim (not as root), edit bar, force a write with w!, and the file is modified!

How can I make the operating system disallow any file modification?

Answer 1

You can set the "immutable" attribute with most filesystems in Linux.

chattr +i foo/bar

To remove the immutable attribute, you use - instead of +:

chattr -i foo/bar

To see the current attributes for a file, you can use lsattr:

lsattr foo/bar

The chattr(1) manpage provides a description of all the available attributes. Here is the description for i:

   A  file with the `i' attribute cannot be modified: it cannot be deleted
   or renamed, no link can be created to this file  and  no  data  can  be
   written  to  the  file.  Only the superuser or a process possessing the
   CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

Answer 2

You can:

1. Change the file owner to root or a dummy newly created user
2. Keep the correct group.
3. Use chmod 440 to allow reading by group (which is you).

If the correct user is not the only one in this group, you should create a new group and add only him in it, and use this group for it. However, you are not the owner of the file, therefore your vi cannot change the file owner.