The Stack Overflow podcast is back! Listen to an interview with our new CEO.
2 added a note of thanks to slm since he added more answer over my answer too.
source | link

Thanks to Ramesh, slm and Stéphane for pointing me in the right direction (I was missing the -R switch for lsattr). Unfortunately, none of the answers so far worked correctly for me.

I came up with the following:

lsattr -aR .//. | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

This protects against newlines being used to make a file appear as being immutable when it is not. It does not protect against files that are set as immutable and have newlines in their filenames. But since such a file would have to be made that way by root, I can be confident that such files don't exist on my filesystem for my use case. (This method is not suitable for intrusion detection in cases where the root user may be compromised, but then neither is using the same system's lsattr utility which is also owned by the same root user.)

Thanks to Ramesh and Stéphane for pointing me in the right direction (I was missing the -R switch for lsattr). Unfortunately, none of the answers so far worked correctly for me.

I came up with the following:

lsattr -aR .//. | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

This protects against newlines being used to make a file appear as being immutable when it is not. It does not protect against files that are set as immutable and have newlines in their filenames. But since such a file would have to be made that way by root, I can be confident that such files don't exist on my filesystem for my use case. (This method is not suitable for intrusion detection in cases where the root user may be compromised, but then neither is using the same system's lsattr utility which is also owned by the same root user.)

Thanks to Ramesh, slm and Stéphane for pointing me in the right direction (I was missing the -R switch for lsattr). Unfortunately, none of the answers so far worked correctly for me.

I came up with the following:

lsattr -aR .//. | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

This protects against newlines being used to make a file appear as being immutable when it is not. It does not protect against files that are set as immutable and have newlines in their filenames. But since such a file would have to be made that way by root, I can be confident that such files don't exist on my filesystem for my use case. (This method is not suitable for intrusion detection in cases where the root user may be compromised, but then neither is using the same system's lsattr utility which is also owned by the same root user.)

1
source | link

Thanks to Ramesh and Stéphane for pointing me in the right direction (I was missing the -R switch for lsattr). Unfortunately, none of the answers so far worked correctly for me.

I came up with the following:

lsattr -aR .//. | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

This protects against newlines being used to make a file appear as being immutable when it is not. It does not protect against files that are set as immutable and have newlines in their filenames. But since such a file would have to be made that way by root, I can be confident that such files don't exist on my filesystem for my use case. (This method is not suitable for intrusion detection in cases where the root user may be compromised, but then neither is using the same system's lsattr utility which is also owned by the same root user.)