chattr changes Linux filesystem attribute flags that sit outside ordinary chmod permissions and ACLs. It is the companion command to lsattr: use lsattr to inspect attributes, then use chattr only when you understand which flag needs to change.

This lesson follows Linux Command #54 – lsattr, Linux Command #52 – getfacl, and Linux Command #50 – chmod. Together, these tools help separate filesystem attributes from ACLs and ordinary Unix mode bits.

What You’ll Learn

• Explain what chattr changes.
• Use +i and -i to set and clear the immutable attribute.
• Use +a and -a to control append-only behavior.
• Understand the difference between +, -, and =.
• Verify every change with lsattr.
• Recognize filesystem and privilege limitations.
• Troubleshoot files that cannot be modified, renamed, or deleted.

Server Gyan demonstrates changing Linux file attributes with chattr, including common attribute flags and practical command syntax.

What chattr Changes

The current chattr(1) manual defines chattr as the command for changing file attributes on a Linux filesystem. Its symbolic mode uses three operators: + adds selected attributes, - removes selected attributes, and = replaces the current set with exactly the attributes you specify.

The general form is chattr MODE FILE.... In day-to-day administration, the most important modes are usually +i, -i, +a, and -a.

Important: attribute support varies by filesystem. The e2fsprogs manual explicitly warns that not every flag is supported or used by every filesystem. When behavior is unexpected, identify the filesystem first with a command such as findmnt -T FILE and then consult that filesystem’s documentation.

Make a File Immutable

Use sudo chattr +i FILE to add the immutable attribute when the filesystem supports it. For example:

sudo chattr +i important.conf
lsattr important.conf

With the i flag set, the file cannot normally be modified, renamed, deleted, or linked. The current manual states that only the superuser or a process with the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

A LinuxQuestions discussion shows a practical reason administrators use chattr +i: normal read-only permissions do not necessarily stop a file from being unlinked when the directory permissions allow deletion.

Remove the Immutable Attribute

When a legitimate change is required, first confirm why the immutable flag exists. Then remove it with:

sudo chattr -i important.conf
lsattr important.conf

After verification, make the intended change. If the file is supposed to remain protected, restore the immutable attribute with sudo chattr +i important.conf and verify again with lsattr.

Use Append-Only for Logs and Records

The a attribute is append only. A file carrying this flag can be opened for writing only in append mode. Existing contents cannot normally be overwritten or truncated while the flag remains set.

sudo chattr +a audit.log
lsattr audit.log
printf '%s\n' 'new record' | sudo tee -a audit.log
sudo chattr -a audit.log

This can be useful for specific logging or record-keeping workflows, but it is not a substitute for a complete logging, backup, or security architecture.

A LinuxQuestions thread highlights an important distinction: append-only behavior is a filesystem attribute, not one of the normal read/write/execute permission bits.

Understand +, -, and =

• chattr +i FILE — add immutable while preserving other changeable attributes.
• chattr -i FILE — remove immutable while preserving other attributes.
• chattr +a FILE — add append-only.
• chattr -a FILE — remove append-only.
• chattr =a FILE — replace the changeable attribute set with append-only. Use = carefully because it is not merely additive.

For routine administration, + and - are usually safer because they change only the named attribute. Do not use = unless you deliberately intend to replace the existing changeable attribute set.

Directories Behave Differently Than Files

Making a directory immutable does not automatically apply the i flag to every child file. Instead, the directory itself cannot be modified, which prevents operations such as creating, removing, or renaming directory entries. Existing child files may still be editable if their own attributes and permissions allow it.

If you truly intend to change attributes recursively, chattr provides -R. Treat recursive attribute changes as high impact. Inspect the target path first, use a disposable lab when learning, and avoid broad commands against system trees unless you have a documented reason and recovery plan.

Linux eHub demonstrates immutable-file behavior, including setting +i, testing modification and deletion, verifying with lsattr, and clearing the attribute.

Not Every lsattr Flag Can Be Changed

lsattr can display some read-only attributes that chattr cannot change. The current manual identifies encrypted (E), indexed-directory (I), inline-data (N), and verity (V) attributes as read-only from chattr‘s perspective.

Do not assume that every letter shown by lsattr is something you should remove. Some attributes describe filesystem implementation details rather than an administrator-applied protection flag.

Real-World Troubleshooting Workflow

1. Reproduce the failure without destructive retries.
2. Check ownership and mode bits with ls -ld or stat.
3. Check ACLs with getfacl.
4. Inspect file attributes with lsattr FILE.
5. Inspect the parent directory with lsattr -d PARENT_DIRECTORY.
6. Identify the filesystem with findmnt -T FILE.
7. If i or a is set, determine whether it is intentional.
8. Change only the required attribute with chattr.
9. Run lsattr again to verify the exact resulting state.
10. Document or restore the protection if the application expects it.

Operational caution: the e2fsprogs manual notes that setting a or i does not retroactively block writes through file descriptors that were already open. Attribute changes should therefore be treated as one control within a larger operational and security design, not as a complete isolation mechanism.

Hands-On Exercise

1. Create a disposable directory: mkdir -p ~/chattr-lab.
2. Create a test file: printf 'baseline\n' > ~/chattr-lab/test.txt.
3. Record its baseline attributes with lsattr ~/chattr-lab/test.txt.
4. Set immutable: sudo chattr +i ~/chattr-lab/test.txt.
5. Verify with lsattr.
6. Attempt a normal edit, rename, and deletion. Record the errors instead of forcing the operations.
7. Clear immutable with sudo chattr -i ~/chattr-lab/test.txt.
8. Set append-only with sudo chattr +a ~/chattr-lab/test.txt.
9. Append one line with tee -a, then verify that truncating the file fails.
10. Clear append-only with sudo chattr -a ~/chattr-lab/test.txt.
11. Remove the disposable lab directory when finished.

Knowledge Check

1. What does chattr change?
2. What does +i do?
3. What does -i do?
4. What is the purpose of +a?
5. Why should lsattr be run after chattr?
6. What is the difference between + and =?
7. Why can the same attribute behave differently across filesystems?
8. Which capability can permit setting or clearing immutable/append-only attributes?
9. Does setting +i on a directory recursively apply i to every child file?
10. Why should recursive chattr -R commands be used cautiously?

Answers

1. Filesystem attribute flags.
2. It adds the immutable attribute when supported.
3. It removes the immutable attribute.
4. It makes supported writes append-only while the attribute is set.
5. To verify the actual resulting attribute state.
6. + adds named attributes; = replaces the changeable set with exactly what is specified.
7. Not every filesystem implements every attribute or implements it identically.
8. CAP_LINUX_IMMUTABLE.
9. No. The directory itself becomes immutable; recursive application requires -R.
10. They can affect many files and directories at once and may disrupt services or recovery workflows.

Key Takeaway

chattr changes Linux filesystem attributes; lsattr verifies them. Use immutable and append-only flags deliberately, understand the filesystem underneath them, and change only the attribute required for the task.

Next in this Linux command sequence: Linux Command #56 will continue with another filesystem-inspection tool after this attribute pair.

BitcoinVersus.Tech provides technical education and analysis for informational purposes only. Test administrative commands in a disposable environment before applying them to production systems.