It is a very powerful method to set files as not modifiable even by the root user. Usually configuration files, binaries, and libraries, which are static in nature, are good candidates to set as immutable.
Before you change the file attribute to immutable, be absolutely sure that these files are static and may not cause outages.
listener.ora
, modify it as immutable by executing the following command:[root@nodeorcl1 kit]# chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as ----i--------
[root@nodeorcl1 kit]# echo "" >> /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora bash: /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora: Permission denied
$ORACLE_HOME/rdbms/lib/libknlopt.a
immutable:chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a chattr 1.39 (29-May-2006) Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as ----i--------
Operation not permitted
message:[oracle@nodeorcl1 lib]$ make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk dv_off /usr/bin/ar d /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a kzvidv.o /usr/bin/ar: unable to rename '/u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a' reason: Operation not permitted make: *** [dv_off] Error 1 [oracle@nodeorcl1 lib]$
lattr
command:[root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora ----i-------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora [root@nodeorcl1 kit]#
listener.ora
, execute the following command:[root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora chattr 1.39 (29-May-2006) Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as -------------
lsattr
command can be used to check if the immutable flag is on or off:[root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora ------------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora [root@nodeorcl1 kit]#
The immutable flag can be set with the chattr
command using the +i
switch. To disable the immutable flag use –i
. The –V
switch translates to verbose mode. More about the chattr
command can be found in the man
pages.
In this section we will see how we can use lcap
to prevent the root user from changing the immutable attribute. The kernel capabilities modified with lcap
will stay disabled until the system is rebooted.
The lcap
utility can disable some specific kernel capabilities.
lcap
:[root@nodeorcl1 kit]# rpm -Uhv lcap-0.0.6-6.2.el5.rf.x86_64.rpm warning: lcap-0.0.6-6.2.el5.rf.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6 Preparing... ########################################### [100%] 1:lcap ########################################### [100%] [root@nodeorcl1 kit]#
[root@nodeorcl1 kit]# lcap CAP_LINUX_IMMUTABLE [root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a chattr 1.39 (29-May-2006) Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as ------------- chattr: Operation not permitted while setting flags on /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a
13.59.76.150