Thanks to Ramesh and Stéphane for pointing me in the right direction (I was missing the
-R switch for
lsattr). Unfortunately, none of the answers so far worked correctly for me.
I came up with the following:
lsattr -aR .//. | sed -rn '/i.+\.\/\/\./s/\.\/\///p'
This protects against newlines being used to make a file appear as being immutable when it is not. It does not protect against files that are set as immutable and have newlines in their filenames. But since such a file would have to be made that way by root, I can be confident that such files don't exist on my filesystem for my use case. (This method is not suitable for intrusion detection in cases where the root user may be compromised, but then neither is using the same system's
lsattr utility which is also owned by the same root user.)