Linux chattr command detailed
Common command parameters:
A: Namely Atime, tell the system not to modify the last access time of this file.
S: Sync. Once the application program writes the file, the system immediately writes the modified result to the disk.
a: Append Only, the system only allows additional data after this file, and does not allow any process to overwrite or truncate this file. If the directory has this attribute, the system will only allow files to be created and modified in this directory, but not delete any files.
b: Do not update the last access time of the file or directory.
c: Save the file or directory after compression.
d: When the dump program is executed, the file or directory will not be backed up by dump.
D: Check for errors in the compressed file.
i: Immutable, the system does not allow any modification to this file. If the directory has this attribute, then any process can only modify the files under the directory, and it is not allowed to create and delete files.
s: Delete the file completely and cannot be recovered because it is deleted from the disk, and then fill the area where the file is located with 0.
u: When an application requests to delete this file, the system will reserve its data block so that the file can be restored later to prevent accidental deletion of the file or directory.
t: The file system supports tail-merging.
X: You can directly access the contents of the compressed file.
Commonly used commands show:
chatter: lock the file, cannot be deleted, cannot be changed
chattr +a /etc/passwd # +a: can only add content to the file, but cannot be deleted,
chattr +d /etc/passwd # -d: cannot be deleted
chattr +i /etc/passwd #Lock: The file cannot be deleted, cannot be changed, and cannot be moved.
lsattr /etc/passwd #View and lock: The file adds a parameter i to indicate lock
Case:
[root@HikvisionOS ~]# chattr +i /etc/passwd
[root@HikvisionOS ~]# lsattr /etc/passwd
----i----------- /etc/passwd
chattr -i /home/omd/h.txt #Unlock: "-" means release
Hide chattr command:
which chattr
mv /usr/bin/chattr /opt/benn/
cd /opt/benn/
mv chattr h #-->Change the command, use the alias h to hide the identity
/opt/benn/h +i /home/ omd/h.txt # -->Use h to drive the chattr command
lsattr /home/omd/h.txt # -->View encrypted information
Recover hidden commands:
mv h /usr/bin/chattr
chattr -i /home/omd/h.txt
lsattr /home/omd/h.txt