I'd like to know if I can prevent the root user from deleting a file. Is it possible?
No, this isn't possible. You can set the immutable attribute with
chattr +i, which will at least make it irritating and non-obvious what has to be done to allow writing to the file, but they can just unset it again. Also, your filesystem has to support this, and have the functionality enabled.
SELinux can also do some limiting, but again, it can be disabled.
The better solution is to properly control users and programs by limiting their access, and not allowing them to run as root unless absolutely necessary.
As others have said, generally, the idea of root is a user is permitted to make the machine do anything the machine can do. So, there isn't an easy flag that can prevent root from intentionally deleting a file (
chattr +i can prevent accidental deletion).
But, despite this, there are a couple of solutions:
- Put the file on a fileserver, and configure the fileserver not to allow the delete. This works because local root isn't root on the file server.
- Put the file on WORM media. This works because the hardware will not allow an overwrite, so the data is protected. (Overwrite is not something the machine can do.) Cheap options are CD-R and DVD-R. Make sure your drive indeed cannot overwrite (destroy) already written sections. There are WORM SD cards as well.
Any user with "sudo" privileges or the root user can see and delete everything.
However in an ideal system you wouldn't have to worry about that because only one user have super privileges, and he will only use only when it necessary and always responsively.
It is possible under very specific circumstances:
You can unplug the USB drive where the change occurs, or disconnect the ethernet cable between the computer and the NAS. But chances are that the file will be corrupted or left unreachable or both.
Other than hardware-based action, your may be able to restore the file from a previous backup.