lsattr lists Linux filesystem attributes that are separate from normal chmod permissions and ACL entries. It is especially useful when a file refuses to change or delete even though ownership and mode bits look correct.

This lesson follows Linux Command #53 – setfacl, Linux Command #52 – getfacl, and Linux Command #50 – chmod. Those tools explain ownership, mode bits, and ACLs. lsattr checks another layer: filesystem attribute flags.

Cyber Lessons demonstrates Linux file attributes with lsattr and chattr, showing how these flags differ from ordinary permissions.

Learning Objectives

• Explain what lsattr reads.
• Distinguish filesystem attributes from mode bits, ACLs, and extended attributes.
• Read common lsattr output flags.
• Inspect one file, one directory, hidden files, or a recursive tree.
• Recognize immutable and append-only attributes.
• Troubleshoot files that cannot be edited, renamed, or deleted.

What lsattr Reads

The current lsattr(1) manual page describes lsattr as the tool for listing file attributes on ext2, ext3, and ext4 filesystems. The command is part of the e2fsprogs package. Other Linux filesystems may expose some compatible flags, but support varies by filesystem and kernel implementation.

A basic check is simply lsattr FILE. The output normally shows a row of attribute positions followed by the pathname. A dash means that attribute is not set. A letter means the corresponding attribute is present.

Example output might look like ----i-------------- config.txt. The i means the immutable flag is set. That flag is not visible in ordinary ls -l mode bits.

Common Attributes You May See

• i — immutable. The file cannot normally be modified, renamed, or deleted while the flag remains set.
• a — append only. Existing content cannot normally be overwritten; supported writes are appended.
• A — do not update access time.
• d — exclude the file from traditional dump backups.
• S — request synchronous file updates.
• e — the file uses extents. This is commonly seen on ext4 and is normally informational.
• I — indexed directory. This is a read-only attribute from the chattr user’s perspective.

The companion chattr(1) manual page documents the broader flag set and notes that some flags are read-only and that not every filesystem supports every attribute. Do not assume a letter has identical practical behavior on every filesystem.

CodeLucky walks through practical chattr and lsattr examples, including immutable and append-only files.

Check One File

Command: lsattr report.txt

If the output contains only dashes plus common informational flags, the file may not have a restrictive attribute. If you see i, a, or another meaningful flag, investigate that attribute before changing permissions or ownership.

Inspect a Directory Itself

Running lsattr DIRECTORY normally lists entries inside the directory. To inspect the directory object itself, use lsattr -d DIRECTORY. That distinction matters because an immutable directory can block creating, deleting, or renaming entries inside it even when the child files themselves do not carry the immutable flag.

A LinuxQuestions discussion demonstrates the difference between making a directory immutable and recursively applying the immutable attribute to the files inside it.

Include Hidden Files

Use lsattr -a DIRECTORY to include entries whose names begin with a dot. This is useful when troubleshooting configuration directories because hidden files may carry an attribute even when visible files do not.

List Attributes Recursively

Use lsattr -R DIRECTORY to recurse through a directory tree. Recursive output can become large quickly, so narrow the path before running it on production systems. If permissions block traversal, use appropriate privileges rather than automatically running broad recursive commands against the entire filesystem.

A targeted troubleshooting example is sudo lsattr -R /var/log. That can help identify unusual immutable or append-only flags in a logging tree, but the output should be interpreted carefully because many normal filesystem attributes are not security problems.

A recent LinuxTeck example uses lsattr to locate files carrying restrictive attribute flags before attempting to change them.

Use Long Attribute Names

The -l option prints attribute names in long form rather than relying only on single-letter positions. Try lsattr -l FILE when you are learning the command or when a less familiar attribute appears.

lsattr Is Not getfacl

getfacl reads access-control entries for users and groups. lsattr reads filesystem attribute flags. They solve different problems. A file can have ordinary mode bits, ACL entries, and filesystem attributes at the same time.

If a user cannot read a file, start with ownership, chmod, and ACLs. If even a privileged process cannot modify or remove a file as expected, lsattr should move much higher in the troubleshooting order.

lsattr Is Also Not getfattr

Linux also has extended attributes, often called xattrs. Those are name-and-value pairs such as user.example=value. They are inspected with tools such as getfattr, not lsattr. Filesystem flags and xattrs are different mechanisms even though both use the word “attribute.”

Useful lsattr Commands

• lsattr FILE — list attributes on one file.
• lsattr FILE1 FILE2 — inspect several files.
• lsattr -d DIRECTORY — inspect the directory object itself.
• lsattr -a DIRECTORY — include hidden entries.
• lsattr -R DIRECTORY — recurse through a tree.
• lsattr -l FILE — show long attribute names.
• lsattr -p FILE — show the file’s project number when supported.
• lsattr -v FILE — show the version or generation number when supported.

Troubleshooting a File That Will Not Delete

1. Check the file and parent directory with ls -ld.
2. Confirm ownership with stat or ls -l.
3. Inspect ACLs with getfacl.
4. Run lsattr FILE.
5. Run lsattr -d PARENT_DIRECTORY.
6. If i appears, identify why the object was made immutable before removing the flag.
7. If the command reports unsupported behavior, identify the filesystem with findmnt -T FILE.
8. Change only the setting you understand, then test again.

Do not use chattr -i reflexively on system files. Immutable flags are sometimes intentional. They may protect configuration, logs, or application state. Inspect the service, package, automation, or security control responsible for the file before changing it.

Practice Lab

1. Create a disposable directory named attr-lab and create two files inside it.
2. Run lsattr attr-lab/* and record the baseline output.
3. Run lsattr -d attr-lab and compare directory output with child-file output.
4. Run lsattr -l attr-lab/* and compare long names with the normal letter positions.
5. Add one hidden file and confirm that lsattr -a attr-lab shows it.
6. If your disposable filesystem supports it, use chattr in the next lesson to set an attribute, then return to lsattr to verify the change.

Knowledge Check

1. What does lsattr display?
2. Which letter commonly indicates an immutable file?
3. Which option inspects the directory itself instead of its contents?
4. Which option includes dotfiles?
5. Which option lists a tree recursively?
6. Why can ls -l look normal while a file still refuses to delete?
7. What is the difference between lsattr and getfacl?
8. Why should filesystem type be checked when an attribute is unsupported?

Answers

1. Filesystem attribute flags associated with files and directories.
2. i.
3. -d.
4. -a.
5. -R.
6. Filesystem attributes such as immutable are separate from ordinary mode bits.
7. lsattr reads filesystem flags; getfacl reads ACL entries for users and groups.
8. Attribute support and behavior vary by filesystem.

Key Takeaway

lsattr is the inspection tool for Linux filesystem attribute flags. When permissions and ACLs look correct but a file still behaves as if it is protected, check lsattr on both the file and its parent directory before changing anything.

BitcoinVersus.Tech Editor’s Note: The primary reference used for this lesson is the current lsattr(1) manual from e2fsprogs. Attribute support varies by filesystem, so validate behavior on the actual filesystem used in production.

Support independent technology education: Bitcoin donations help fund BitcoinVersus.Tech research and publishing.

BitcoinVersus.Tech provides technical education and analysis for informational purposes only.