How to Use the Linux lsattr Command to View File Attributes

Beyond Standard Permissions

In Linux, the standard read, write, and execute permissions (managed by chmod) are usually sufficient for controlling who can access a file. However, there are times when standard permissions fail to protect a file from accidental destruction, even by the root user.

For example, you might have a critical configuration file that should never be altered or deleted, not even by an administrator typing a sloppy rm * command. Or, you might have a log file that should only allow data to be appended to the end of it, but never overwritten.

To enforce these deep, filesystem-level rules, Linux relies on File Attributes (specific to the ext2/ext3/ext4 file systems).

To see these hidden rules, you cannot use the standard ls command. You must use the lsattr (List Attributes) command.

Step 1: Viewing Standard Attributes

The lsattr command is very straightforward. If you want to see the attributes of all files in your current directory, simply open your terminal and type:

lsattr

The output looks very different from a standard directory listing. You will see a string of dashes and letters on the left, followed by the filename on the right:

-------------e-- ./document.txt
----i--------e-- ./critical_config.conf
-----a-------e-- ./system_log.log

Each letter represents a specific, active attribute.

Step 2: Understanding the Output Codes

What do those letters actually mean? Here are the most common and important attributes you will encounter when using lsattr:

• e (Extents): This simply means the file is using the modern “extents” format for mapping its data on the hard drive (standard for ext4). You will see this on almost every file.
• i (Immutable): This is the most powerful attribute. A file marked with i cannot be modified, deleted, renamed, or linked to, not even by the root user. It is completely locked in stone.
• a (Append Only): A file marked with a can only be added to. You cannot edit existing data or delete the file. This is crucial for securing log files from tampering.
• s (Secure Deletion): When a file marked with s is deleted, its blocks are completely zeroed out on the hard drive, making data recovery impossible.
• u (Undeletable): When a file with u is deleted, its contents are preserved, allowing for easier undeletion later.

Step 3: Viewing Attributes of a Specific Directory

If you run lsattr on a directory, it lists the attributes of the contents of that directory, not the directory itself.

If you want to know if the directory folder itself is marked as immutable, you must use the -d (directory) flag.

lsattr -d /etc/ssh/

This will show you the attributes of the /etc/ssh/ folder, rather than the files inside it.

Step 4: Viewing Hidden Files and Recursive Directories

Just like the standard ls command, lsattr has flags to dive deeper into your file system.

To see the attributes of hidden files (files starting with a dot, like .bashrc), use the -a (all) flag:

lsattr -a

To view the attributes of a folder, the files inside it, and every sub-folder beneath it, use the -R (Recursive) flag:

lsattr -R /var/www/html/

Step 5: How to Change the Attributes

The lsattr command only reads the attributes. If you find a file marked as Immutable (i) and you genuinely need to edit it, you cannot use chmod or sudo nano to force your way in.

You must use the sister command, chattr (Change Attributes), to remove the lock.

For example, to remove the Immutable flag from a configuration file (which always requires sudo), you would use a minus sign (-):

sudo chattr -i critical_config.conf

If you run lsattr again, the i will be gone, and you can edit the file normally.