I would like to protect certain configuration files from accidental modification or deletion. I discovered that Linux features allow you to do this by setting the ‘i’ attribute on these files:
# chattr +i <file> to enable it and # chattr -i <file> to disable it. I’ve also read that certain privileged processes with the CAP_LINUX_IMMUTABLE capability can also modify this attribute. But I can’t find any examples of such processes. I tried using this command:
~# less /proc/*/status | grep "CapIm"
~#
But could it be that “CapIm” isn’t the right pattern to use when searching for the pattern “CAP_LINUX_IMMUTABLE”? What would be the right one, then?
