Immutable storage mounts

Protect critical system configuration files using immutable filesystem attributes.

In this lesson, you will learn how to protect critical system configuration files from accidental modification or deletion by applying immutable filesystem attributes.

What are Immutable Attributes?

In Linux, certain filesystems (like ext4 or xfs) allow you to set special flags on individual files or directories that lock them down beyond standard permission settings. Even if you are logged in as the root user, the system will prevent you from renaming, deleting, or modifying a file marked as "immutable." This is an excellent way to prevent "fat-finger" mistakes when working with sensitive configuration files like /etc/passwd or /etc/fstab.

Setting and Removing Attributes

To manage these attributes, we use the chattr (change attribute) command. The specific attribute for immutability is i.

Setting the immutable flag: To lock a file so that even root cannot change it, use the +i flag:
```
sudo chattr +i /etc/my-critical-config.conf
```
Verifying the attribute: You can check if the flag is active by using lsattr (list attributes):
```
lsattr /etc/my-critical-config.conf
# Output will show: ----i---------e----
```
Removing the immutable flag: If you eventually need to update the file, you must first remove the immutable attribute using the -i flag:
```
sudo chattr -i /etc/my-critical-config.conf
```

Why use this instead of permissions?

Standard file permissions (chmod) rely on user identity. If you are root, you can simply chmod a file to grant yourself write access and change it. However, the i attribute operates at the filesystem level. Because the kernel respects this flag regardless of your user ID, it provides a much stronger safety net against scripts or accidental commands that might attempt to overwrite vital configuration data.

Remember, this is a tool for safety, not a replacement for robust security auditing or encryption; it protects against accidental changes, but it does not prevent someone with physical or administrative access from simply using chattr -i to remove the protection.

Key Takeaway: The chattr +i command provides a filesystem-level lock that prevents even the root user from modifying or deleting protected configuration files until the attribute is explicitly removed.