Is there any chattr flag that would allow me to lock a file's unix permissons, and not change them without resetting the flag? The file itself should still be modifiable, I just want to prevent ... ignorant people ... from changing the permissions to something wrong accidentally.

  • I don't think this question is particularly helpful. If there is such a flag, all is well. But if there isn't, how can it be answered? Only if someone reads the chattr manpage from top to bottom to be sure there really is none. And this you could do yourself. Much better would be a more open question. "How do I prevent other users from accidentally changing permissions on a file?"
    – fschmitt
    Nov 1 '10 at 13:55
  • 1
    @fschmitt so we should only ask questions that we know have an answer? I'm asking other people if I'm simply ignorant and there is a way. I once saw a question on SO with the answer "not possible", which then hand an answer "now module X exists" but that was still no real solution. So I took "module X" and made "module Y" use it, and now there's an actual solution. Nov 2 '10 at 0:18
  • see this question
    – TecBrat
    Aug 10 '12 at 21:07

There is no such flag with Linux chattr. You can either make the file immutable or append-only (in either case, the file's permissions and ownership will be locked), or allow the owner of the file and root to change the permissions. (The immutable attribute on a directory prevents creating or removing files from it but not changing entries' metadata.)

If changing the ownership of the file is acceptable, do it, and use access control lists (or group ownership) to give whoever needs it read and write access to the file. If this is a social issue where your fellow roots can't be relied on, I don't think you'll find a satisfactory technical issue.

Disallowing the owner of a file to change permissions falls into the category of mandatory access control, which is not something unix traditionally supports. There are several MAC frameworks on Linux, and the two major ones are SELinux and AppArmor; I don't know whether they do allow what you're trying to do.

If this is a general problem, you could look into using a database for storage. You can typically give someone the permission to read and write to a table without letting them control the permissions.

A less drastic step than moving to a database would be moving the files to a different filesystem (this may or may not be feasible in your setting). You could then use symbolic links in the place where the files must exist, and hope the permission changers aren't sophisticated enough to look in the place where the real files are (perhaps that could be made read-only?).

A FUSE filesystem that mirrors file contents but changes metadata is another possibility. An existing one is bindfs, which can rewrite permissions (-o perms=…) and can ignore chmods (-o chmod-ignore).

  • it was totally a social issue, where people carelessly run fix perms scripts which reset everything to 755/644. Nov 2 '10 at 0:20
  • @xenoterracide: If it's a social issue, it might be enough to be more technically sophisticated than the others. Maybe you could “hide” the files (or more precisely their permissions) away on a separate filesystem (see my edit). Nov 2 '10 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.