chattr Command in Linux: Set File Attributes with lsattr

chattr sets and removes special file attributes that operate at the filesystem level, separate from standard permission bits. You can mark a file immutable so nothing can delete or overwrite it, or set a log file to append-only so new entries go in but existing content stays intact. Its companion command lsattr displays the current attributes on any file.

How to Use the chattr Command in Linux

The syntax is:

bashchattr [OPTIONS] [OPERATOR][ATTRIBUTES] FILE...

Three operators control how attributes are applied:

The most useful attribute flags are:

Two flags appear in the chattr manual but are not honored by ext2, ext3, or ext4 kernels: s (secure deletion) and u (undeletable). Setting them has no effect on those filesystems.

Setting or clearing i and a requires root.

View File Attributes with lsattr

Before changing attributes, check what is already set:

bashlsattr todo.txt# ----i------A--e----- todo.txt

Each position corresponds to an attribute flag. Dashes are placeholders for unset flags. The e flag (extents) appears by default on ext4 and cannot be removed with chattr — it is managed by the filesystem itself.

Useful lsattr options:

bashlsattr -l /etc/     # descriptive names instead of single-letter flagslsattr -a /etc/     # include hidden dot fileslsattr -d /etc/     # show attributes of the directory itself, not its contentslsattr -R /etc/     # recursive listing of entire directory tree

Make Files Immutable or Append-Only

Immutable file — nothing can modify, delete, or rename it, even as root:

bashsudo chattr +i ~/demo.txtlsattr ~/demo.txt# ----i---------e----- /home/user/demo.txt

To edit or delete the file again, clear the flag first:

bashsudo chattr -i ~/demo.txt

Append-only log file — new data can go in, but existing content cannot be overwritten or truncated:

bashsudo chattr +a /var/log/app.logecho "new entry" >> /var/log/app.log        # worksecho "overwrite" > /var/log/app.log         # fails: Operation not permitted

The a flag applies to new write attempts. Existing open file descriptors are not affected retroactively — this is by kernel design, as noted in the chattr manual.

Combine multiple flags in one command:

bashsudo chattr +iA todo.txt    # immutable + no atime updates at oncesudo chattr -iA todo.txt    # clear both at once

File attributes are not preserved when copying with cp or rsync — you need to reapply them after a copy.

Apply Attributes Recursively and Use the = Operator

The = operator sets exactly the flags you specify and clears all other user-settable attributes:

bashsudo chattr =A todo.txt

This leaves only A set. Filesystem-managed flags like e are not affected and may still appear in lsattr output.

Recursive changes with -R apply to a directory and everything inside it:

bashsudo chattr -R +i ~/config/sudo chattr -R -i ~/config/    # reverse before any updates

⚠️ Warning: Applying +i recursively to system directories like /etc/nginx/ will prevent package managers and configuration tools from updating files there. Remove the flag before running system updates.

If chattr fails even with sudo, verify the filesystem supports it: df -T /path/to/file. FAT, NFS, and tmpfs do not support these attributes.

Use lsattr before making any change, +i to protect critical files from accidental deletion, +a for log integrity, and = when you need to set exact attributes cleanly. Leave a comment below if you run into any issues.