what does the a
in chattr +ia <filename>
do? and why would you add the a
in combination with the i
? note: I know the i
is for immutable
1 Answer
The letters `acdeijstuADST' select the new attributes for the files: append only (a), compressed (c), no dump (d), extent format (e), immutable (i), data journalling (j), secure deletion (s), no tail-merg‐ ing (t), undeletable (u), no atime updates (A), synchronous directory updates (D), synchronous updates (S), and top of directory hierarchy (T).
from the manpage for
chattr
Files with this flag will fail to be opened for writing. This also blocks certain potentially destructive system calls such as truncate()
or unlink()
.
$ touch foo
$ chattr +a foo
$ python
> file("foo", "w") #attempt to open for writing
[Errno 1] Operation not permitted: 'foo'
> quit()
$ truncate foo --size 0
truncate: cannot open `foo' for writing: Operation not permitted
$ echo "Appending works fine." >> foo
$ cat foo
Appending works fine.
$ rm foo
rm: cannot remove `foo': Operation not permitted
$ chattr -a foo
$ rm foo
This option is designed for log files.
-
2but why would you do immutable and append only? immutable kind of prevents any writing... (we do this at work when locking sites for TOS violations and I don't understand why the a) Oct 30, 2010 at 13:03
-
@xeno that's a good question. At first analysis +a adds nothing that +i doesn't do (except paranoia); I'd check the source code of your kernel to be extra sure.– badpOct 30, 2010 at 13:15
-
@xenoterracide: I don't see much point. It could be belt and braces, in case someone removes the
i
(but someone who wants to and knows how do remove the immutable attribute would know about the append-only attribute anyway). Oct 30, 2010 at 13:16 -
1"belt and braces" in English means "belt and suspenders" in American for our international readers.– mswOct 30, 2010 at 16:04