History
When the interviewer asked me this question, I was honestly stunned—how could root not delete a file it owns? It didn’t make sense at first. Luckily, I cleared the interview, but the very first thing I did afterward was dig into it. That’s when I learned about the immutable attribute and how powerful it really is.
What’s really blocking root?
Even as root, you can be denied deletion if the file (or its parent directory) is marked immutable. Linux has special attributes that sit below normal permissions. These aren’t visible in ls -l and they override typical access rules—including root’s ability to modify or remove the file.
1.Which command shows file attributes that ls will never display?
#lsattr
2.You notice a flag like this: ----i-------. What does that i actually mean?
The i stands for immutable.
* When set, the file cannot be modified, renamed, deleted, linked, or truncated—not even by root.
* It’s enforced by the kernel via filesystem flags (supported on ext2/3/4, XFS, btrfs, etc.).
* Think of it as a “kernel-level read-only lock” that beats normal permissions and even SELinux permissive mode.
3.What exact command removes that protection so the file can finally be deleted?
Use chattr (change attributes) to remove the immutable flag:
#chattr -i /etc/old_config.conf
If the immutable flag was on the directory (e.g., /etc), you’d need to remove it:
#chattr -i /etc
Bonus: Why would an admin intentionally apply this flag to a file like /etc/resolv.conf?
/etc/resolv.conf controls DNS resolution. It’s commonly modified by:
* Network managers (NetworkManager, systemd-resolved),
* DHCP clients (dhclient, dhcpcd),
* Cloud-init or provisioning tools.
Admins sometimes set it immutable to:
* Prevent auto-overwrites by DHCP or network daemons,
* Lock in known-good DNS during troubleshooting or in hardened environments,
* Defend against misconfigurations or malware altering name resolution.
.png "Commander"){kind=icon}
