FreeBSD: How to write protect important file ( even root can NOT modify / delete file )
The chflags utility modifies the file flags of the listed files as specified by the flags operand.
FreeBSD offers write protection, you need to to set special bit call immutable. Once this bit is setup no one can delete or modify file including root. And only root can clear the File immutable bit.
You must be a root user to setup or clear the immutable bit.
Setup file immutable bit
Use chflags command as follows:
# chflags schg /tmp/test.doc
Try to remove or moify file file with rm or vi:
# rm -f /tmp/test.doc
Output:
rm: /tmp/test.doc: Operation not permitted
Now root user is not allowed to remove or modify file. This is useful to protect important file such as /etc/passwd, /etc/master.passwd etc.
Display if file immutable bit is on or off
ls -lo /tmp/test.doc
Output:
-rw-r--r-- 1 root wheel schg 19 Jun 29 22:22 /tmp/test.doc
Clear or remove file immutable bit
#chflags noschg /tmp/test.doc
Now you can remove or modify file. Please note that immutable flag can be set by root user only. chflags also supports few other interesting flags.
- arch: set the archived flag
- nodump: set the nodump flag
- sappnd: set the system append-only flag
- schg: set the system immutable flag
- sunlnk: set the system undeletable flag
- uappnd: set the user append-only flag
- uchg: set the user immutable flag
- uunlnk: set the user undeletable flag
Putting the letters no before an option causes the flag to be turned off.
Please note Linux also supports immutable flag to write protect files using chattr command.
See man page chflags and ls commands for more information.
You may also be interested in other helpful articles:
- Protect harddisk-based backup from accidental removal
- Howto: Protect account against a password cracking attack
- Laptop Battery Safety - protect yourself from flames
- Understanding UNIX / Linux filesystem Inodes
- Lighttpd Protect Different Directories With Different Password Files
Discussion on This Article:
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Tags: chflags_command, etc passwd, immutable bit, protect files, root user, write protection
Hey thanks for this tip
Two questions:
How to write protect
Is it legal