Is it possible from a bash running as a non-privileged user to mark the file immune so it cannot be altered in any way from any process running as that user? It is OK if other users or a root can alter it.
My user case is to prepare a config file before starting another process. I want to prevent that process from doing any modifications to the file either through a bug or through a deliberate exploit.
chmod a-w path or similar is not good as it can be trivially undone. I cannot change ownership of the file as the process is not root. I also cannot use
chattr +i path as the process does not have CAP_LINUX_IMMUTABLE.
Is the only option to have a setuid/sudo program or a program with CAP_LINUX_IMMUTABLE set on its executable that does such alteration?