File attributes on Linux
October 14, 2021
File attributes on Linux file systems
Each file has a specific set of properties in the file system. For example, these are access permissions, owner, name, timestamps. In Linux, each file has quite a few properties, for example, access permissions are set three times (for the owner, group and all others), timestamps can also be of three different types (creation time, change and access time).
Some of the properties of files in the current directory can be viewed with the command:
An example of the properties of one of the files:
-rw-rw-r-- 1 mial users 262144 авг 18 15:04 custom-x.cramfs.img
However, file properties should not be confused with metadata. Metadata is information that is stored in the file itself, regardless of the file system. And the file properties are specific to the file system and can be lost, for example, when transferring a file from the EXT4 file system to NTFS, some file properties (for example, access rights or timestamps) will be lost because the NTFS file system does not support them.
Linux users are usually aware of file access modes. But files and directories can be set to attributes that are not remembered by all users. This article is devoted to the file attributes, as well as utilities for setting and reading file attributes.
File attributes can be used by administrators and users to protect files from accidental deletions and changes, and they can also be used by attackers to make it impossible to delete a malicious file.
List of file attributes in Linux
There are the following types of extended attributes.
A file with the 'a' attribute set can only be opened in append mode for writing. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.
When a file with the 'A' attribute set is accessed, its atime record is not modified. This avoids a certain amount of disk I/O for laptop systems.
A file with the 'c' attribute set is automatically compressed on the disk by the kernel. A read from this file returns uncompressed data. A write to this file compresses data before storing them on the disk. Note: please make sure to read the bugs and limitations section at the end of this document. (Note: For btrfs, If the 'c' flag is set, then the 'C' flag cannot be set. Also conflicts with btrfs mount option 'nodatasum')
A file with the 'C' attribute set will not be subject to copy-on-write updates. This flag is only supported on file systems which perform copy-on-write. (Note: For btrfs, the 'C' flag should be set on new or empty files. If it is set on a file which already has data blocks, it is undefined when the blocks assigned to the file will be fully stable. If the 'C' flag is set on a directory, it will have no effect on the directory, but new files created in that directory will have the No_COW attribute set. If the 'C' flag is set, then the 'c' flag cannot be set.)
A file with the 'd' attribute set is not a candidate for backup when the dump program is run.
When a directory with the 'D' attribute set is modified, the changes are written synchronously to the disk; this is equivalent to the 'dirsync' mount option applied to a subset of the files.
The 'e' attribute indicates that the file is using extents for mapping the blocks on disk. It may not be removed using chattr.
A file, directory, or symlink with the 'E' attribute set is encrypted by the file system. This attribute may not be set or cleared using chattr, although it can be displayed by lsattr.
A directory with the 'F' attribute set indicates that all the path lookups inside that directory are made in a case-insensitive fashion. This attribute can only be changed in empty directories on file systems with the casefold feature enabled.
A file with the 'i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.
The 'I' attribute is used by the htree code to indicate that a directory is being indexed using hashed trees. It may not be set or cleared using chattr, although it can be displayed by lsattr.
A file with the 'j' attribute has all of its data written to the ext3 or ext4 journal before being written to the file itself, if the file system is mounted with the "data=ordered" or "data=writeback" options and the file system has a journal. When the file system is mounted with the "data=journal" option all file data is already journalled and this attribute has no effect. Only the superuser or a process possessing the CAP_SYS_RESOURCE capability can set or clear this attribute.
A file with the 'm' attribute is excluded from compression on file systems that support per-file compression.
A file with the 'N' attribute set indicates that the file has data stored inline, within the inode itself. It may not be set or cleared using chattr, although it can be displayed by lsattr.
A directory with the 'P' attribute set will enforce a hierarchical structure for project id's. This means that files and directories created in the directory will inherit the project id of the directory, rename operations are constrained so when a file or directory is moved into another directory, that the project ids must match. In addition, a hard link to file can only be created when the project id for the file and the destination directory match.
When a file with the 's' attribute set is deleted, its blocks are zeroed and written back to the disk. Note: please make sure to read the bugs and limitations section at the end of this document.
When a file with the 'S' attribute set is modified, the changes are written synchronously to the disk; this is equivalent to the 'sync' mount option applied to a subset of the files.
A file with the 't' attribute will not have a partial block fragment at the end of the file merged with other files (for those file systems which support tail-merging). This is necessary for applications such as LILO which read the file system directly, and which don't understand tail-merged files. Note: As of this writing, the ext2, ext3, and ext4 file systems do not support tail-merging.
A directory with the 'T' attribute will be deemed to be the top of directory hierarchies for the purposes of the Orlov block allocator. This is a hint to the block allocator used by ext3 and ext4 that the subdirectories under this directory are not related, and thus should be spread apart for allocation purposes. For example it is a very good idea to set the 'T' attribute on the /home directory, so that /home/john and /home/mary are placed into separate block groups. For directories where this attribute is not set, the Orlov block allocator will try to group subdirectories closer together where possible.
When a file with the 'u' attribute set is deleted, its contents are saved. This allows the user to ask for its undeletion. Note: please make sure to read the bugs and limitations section at the end of this document.
The 'x' attribute can be set on a directory or file. If the attribute is set on an existing directory, it will be inherited by all files and subdirectories that are subsequently created in the directory. If an existing directory has contained some files and subdirectories, modifying the attribute on the parent directory doesn't change the attributes on these files and subdirectories.
A file with the 'V' attribute set has fs-verity enabled. It cannot be written to, and the file system will automatically verify all data read from it against a cryptographic hash that covers the entire file's contents, e.g. via a Merkle tree. This makes it possible to efficiently authenticate the file. This attribute may not be set or cleared using chattr, although it can be displayed by lsattr.
You can also remember the sticky bit, the essence of which is that a file with a given bit can only be deleted by the user who owns the file. The sticky bit is set using the chmod program:
chmod +t test.txt
But the sticky bit has nothing to do with the file attributes in question.
Bugs and limitations
The 'c', 's', and 'u' attributes are not honored by the ext2, ext3, and ext4 file systems as implemented in the current mainline Linux kernels. Setting 'a' and 'i' attributes will not affect the ability to write to already existing file descriptors.
The 'j' option is only useful for ext3 and ext4 file systems.
The 'D' option is only useful on Linux kernel 2.5.19 and later.
chattr is a program for setting and changing file attributes
chattr changes the file attributes on a Linux file system.
The format of a symbolic mode is +-=[aAcCdDeFijmPsStTux].
The operator '+' causes the selected attributes to be added to the existing attributes of the files; '-' causes them to be removed; and '=' causes them to be the only attributes that the files have.
The letters 'aAcCdDeFijmPsStTux' select the new attributes for the files:
- append only (a),
- no atime updates (A),
- compressed (c),
- no copy on write (C),
- no dump (d),
- synchronous directory updates (D),
- extent format (e),
- case-insensitive directory lookups (F),
- immutable (i),
- data journaling (j),
- don't compress (m),
- project hierarchy (P),
- secure deletion (s),
- synchronous updates (S),
- no tail-merging (t),
- top of directory hierarchy (T),
- undeletable (u),
- and direct access for files (x).
The following attributes are read-only, and may be listed by lsattr but not modified by chattr:
- encrypted (E),
- indexed directory (I),
- inline data (N),
- and verity (V).
Not all flags are supported or utilized by all file systems; refer to file system-specific man pages such as btrfs, ext4, and xfs for more file system-specific details.
The following command will make the test.txt file locked for deletion, modification, move (i):
sudo chattr +i test.txt
Moreover, even adding sudo to the delete and move commands will not help, this file will not be able to change or delete until the “i” attribute is removed.
The following command removes the “i” attribute:
sudo chattr -i test.txt
If you selected directories as the target for modifying parameters, the -R option will cause the attributes to be recursively changed for the contents of the directories as well.
chattr is part of the e2fsprogs package and is available at http://e2fsprogs.sourceforge.net, although most Linux distributions have this package preinstalled by default.
lsattr is a program to list file attributes in the Linux filesystem
lsattr lists the file attributes on a second extended file system.
To view file attributes, specify the file name:
Recursively list attributes of directories and their contents.
List all files in directories, including files that start with “.”.
List directories like other files, rather than listing their contents.
Print the options using long names instead of single character abbreviations.
List the file's project number.
List the file's version/generation number.
lsattr is part of the e2fsprogs package and is available at http://e2fsprogs.sourceforge.net, although most Linux distributions have this package preinstalled by default.
- How to find out when Linux was installed (100%)
- The in-memory file system - how to use tmpfs (53.9%)
- Instructions for using the file command (53.9%)
- How to find out which process is modifying a file (53.9%)
- An unplugged disk causes a delay in system boot (53.9%)
- Error “Cannot open access to console, the root account is locked” (SOLVED) (RANDOM - 53.9%)