Protect Files with chattr

This is very good for files that shouldn't be changed very often, for example, stuff like /etc/sendmail.cf or /etc/resolv.conf. Think of it as an extra protection layer in addition to file permissions, not instead of.

Let's say you're concerned about possible issues with junior sysadmins who have just been entrusted with root. You've given them the standard "be careful, if you're not sure, ask" lecture. But let's face it; they're new sysadmins. They still might make a mistake, and you don't want them just changing, say, /etc/shadow willy-nilly. You can throw the immutable attribute on /etc/shadow as an added "protection" layer. Sure, since they're root anyway, they can flip the immutable flag off...but it's good to encourage them to really think about what they're doing before they do it.

Even a seasoned sysadmin who's tired can make the mistake of "rm -rf /Directory/I/Really/Wanted". Whoops...well, this flag can help out there, too, if it's applied beforehand. The tired sysadmin--who really should stop and get some sleep before going further--will issue that "rm -rf" command, see the "Operation not permitted" message, realize his butt just got saved, require a rather immediate change in underwear, and prudently stop until a proper nap has been taken.

--TP