Is it possible to set permissions for file to keep it editable but without permission to overwrite?

I mean possibility to edit the file with text editor, but denying any attempt to replace the file by overwriting. The user is root. I know that it is not the common structure of unix file permission, but I am looking for a tricky approach.

I have a package of files, as some of them have been edited/customized from the original version. When updating the package with a new version, I want to replaced any untouched file, but protect the customized files (not to miss edits). Currently, I must do this manually: writing which file has been edited, not to be replaced in new update.

  • 5
    What would be the use case? If you can edit it with an editor, you can replace its content entirely. – Mat Apr 1 '12 at 17:59
  • @Mat is right. This doesn't make any sense. What are you trying to do? – jw013 Apr 1 '12 at 18:35
  • @jw013 why not make sense? I have a package and want to update/replace the package with any new version. However, some files in the destination folder have been edited, I want to avoid replacing them to miss edited content. I want to protect them from being replace while can be edited. – Googlebot Apr 1 '12 at 18:47
  • 1
    If this is an RPM-based distro, that functionality is built-in to the RPM spec. Just define the configuration files as %config(noreplace). If the config files differ from the currently-installed package's checksum, then the file stays the same, and a file with .rpmnew is put in the directory next to the old file. I would hope that other package managers would have similar capabilities, but I'm only familiar with RPM. – jsbillings Apr 2 '12 at 21:39
  • 1
    Rather ask a question about the actual problem (updating a package while not replacing edited files) instead of asking how to implement a (wrong) solution. – mgorven May 14 '12 at 2:05

Since all packages will try to override the config file completely, you could set the file in append only mode by,

chattr +a bb

Thus you can't do remove/truncate the file, only append it.

But in that case, you will stop package manager from upgrading system.

If you just don't want the package manager to override your customized files, you could hold the package, on debian/ubuntu, you could do:

echo package-name hold | dpkg --set-selections

That way this package will not get upgraded, your files are kept.


It depends on what exactly "overwrite" means. If it means changing the data of an existing file, then it's not possible because the operating system has no way of distinguishing an "edit" from an "overwrite" -- they're both changing the data of the file. If it means deleting and creating a new file with the same name (or renaming a new file to this name), then this can be achieved by removing write permission from the directory containing the file. Obviously this would apply to all files in that directory though, not one specific file.


Firs of all, do a tar of the package's important files. Then upgrade. Once you installed the new version, untar the save in another directory, and diff the files you edited with the new-from-package ones. That way you'll see if the new files don't also have important things to be added/changed (ie, the devs may also have added modification to the files you edited, and those changes should be kept too. You can't just replace the new-from-new-package files with your old edits, without checking first if those new files don't contain new important information)


As root do:

chattr +i foo.txt

Then try:

vim foo.txt

change the file in vim and try to save it.

An example use case is chattr +i /etc/resolv.conf so that your pesky network-manager service doesn't overwrite it with some bum file it gets from a misconfigured home/office router.

You can undo it with:

chattr -i foo.txt

In the Linux file system model, that's the best you can do. There isn't any other solution.

  • This prevents the file from being modified, which is not what the OP wants. – mgorven May 14 '12 at 2:02
  • 1
    @mgorven - That's the best you can do! – Eli Rosencruft May 14 '12 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.