Make files immutable with chattr and lsattr

File permissions stop other users, but root can always change or delete a file. Linux filesystems also support attributes that block changes at a lower level. With the immutable flag set, not even root can edit, rename or delete the file until the flag is removed. This guide shows how to use chattr and lsattr, when it helps and why it often explains mysterious "Operation not permitted" errors.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• Root or sudo access over SSH. Setting these flags needs root.
• A filesystem that supports attributes. ext4 supports all flags here; XFS supports the immutable and append-only flags.

What chattr does

chattr sets attributes stored in the filesystem, separate from normal permissions. Two are useful on servers:

• i (immutable): the file cannot be changed, deleted, renamed or linked to. On a directory, nobody can add, remove or rename entries in it.
• a (append-only): the file can only grow. Existing content cannot be changed or removed. Suitable for some log files.

Both are checked before permissions, so they apply to root too.

Check attributes with lsattr

lsattr /etc/resolv.conf

--------------e------- /etc/resolv.conf

Each position is a flag. The e (extents) is normal on ext4 and you can ignore it. An i or a in the output means that flag is set:

----i---------e------- /etc/resolv.conf

List a whole folder with lsattr -d for the folder itself, or lsattr -R to walk into subfolders.

Make a file immutable

sudo chattr +i /etc/important.conf

Now try to change it, even as root:

sudo rm /etc/important.conf

rm: cannot remove '/etc/important.conf': Operation not permitted

Remove the flag when you need to edit the file again:

sudo chattr -i /etc/important.conf

Append-only for logs

sudo chattr +a /var/log/myapp/audit.log

The app can keep writing new lines, but no one can delete or rewrite old ones. That makes it harder for an intruder to cover their tracks.

The trade-off is log rotation: logrotate cannot rename or truncate the file while the flag is set. Either rotate such files with a script that removes the flag first and sets it again after, or keep append-only for files you rotate by hand.

Practical uses

• Protect a config that another tool keeps overwriting, such as a hand-written /etc/resolv.conf. This is a blunt fix; a cleaner one is to configure the tool that writes it, such as systemd-resolved.
• Protect a finished release folder from accidental changes, then remove the flag during the next deploy.
• Guard a small number of key files against a careless rm -rf.

It is not strong security on its own. An attacker with root can run chattr -i just as you can. Malware even uses the flag to make its own files hard to remove.

Find immutable files

When a deletion fails for no clear reason, or you suspect malware has protected its files, search for the flag:

sudo lsattr -R /etc 2>/dev/null | grep -- '----i'

This lists immutable files under /etc. Repeat for other folders, such as /var/www, /tmp or /usr/local. If you find unknown immutable files in places like /tmp or a cron folder, treat it as a sign of compromise and read Find crypto miner processes.

Work recursively

-R applies a flag to a folder and everything inside it:

sudo chattr -R +i /var/www/example.com/releases/2026-11-09
sudo chattr -R -i /var/www/example.com/releases/2026-11-09

Remember to clear it before you try to delete or update the release.

Check it works

Create a test file, protect it and try to change it:

echo test | sudo tee /root/chattr-test
sudo chattr +i /root/chattr-test
echo more | sudo tee -a /root/chattr-test
lsattr /root/chattr-test

The append fails with Operation not permitted, and lsattr shows the i flag. Clean up with sudo chattr -i /root/chattr-test && sudo rm /root/chattr-test.

Troubleshooting

• "Operation not permitted" as root on an ordinary file: the immutable or append-only flag is set. Check with lsattr and remove it with chattr -i or chattr -a.
• "chattr: Operation not supported while setting flags": the filesystem does not support that flag. Check the type with df -T.
• Package update fails on a config file: you made it immutable. Remove the flag, rerun the update, then decide whether you still need it.
• logrotate errors for a log file: the file is append-only. Remove the flag before rotation or rotate it by hand.

Next steps

• Understand normal permissions first: Linux file permissions explained.
• Keep wider security in view: Linux VPS security checklist.