How to restrict root user to access or modify a file and directory in Linux

Now in this article I will show you steps to prevent or restrict access of root user to access certain files or directories. Now by default root is the super user who has access to all the files and directories available on the Linux node but it is also possible to restrict even a root user from accessing and modifying the content of a file or directory.

You can restrict root user from accessing and modifying a file or directory using extended file attributes. We will be dealing with chattr and lsattr to achieve this in our demonstration.
Now chattr - change file attributes on a Linux file system,
supports multiple options but we will be concentrating only on the
options which can help restrict root user access on certain files and
directories.

To get the complete list of options supported with chattr you can view the man page of chattr using below command

# man chattr

We will work with two attributes
a:

• Append text to a file
• Can’t overwrite

i:

• Makes a file immutable
• Can’t be deleted or changed in any way

Create a secret file and directory

Now
before we start we must have a top secret file which needs protection
from root user. I have created a secret_file with below text

[root@node1 ~]# cat /tmp/deepak/secret_file
This is a secret file

Check the assigned attributes

By default when we create a file or directory, it does not has any extended attributes other than “e” which means extent format i.e. these files support extended attributes

[root@node1 ~]# lsattr /tmp/
-------------e-- /tmp/tracker-extract-files.0
-------------e-- /tmp/yum_save_tx.2019-03-22.22-16.7ocUW8.yumtx
-------------e-- /tmp/systemd-private-1ad03926d17f4de68a8fdfdd0449c980-chronyd.service-FhlC0B
-------------e-- /tmp/systemd-private-1ad03926d17f4de68a8fdfdd0449c980-bolt.service-2Oomt7
-------------e-- /tmp/systemd-private-1ad03926d17f4de68a8fdfdd0449c980-rtkit-daemon.service-TEwKlB
-------------e-- /tmp/deepak
-------------e-- /tmp/systemd-private-1ad03926d17f4de68a8fdfdd0449c980-colord.service-cUfgTm
-------------e-- /tmp/yum_save_tx.2019-03-22.22-16.ZCjaVi.yumtx
-------------e-- /tmp/systemd-private-1ad03926d17f4de68a8fdfdd0449c980-cups.service-5yacYU

Restrict access and allow only to append content

Now we will use “+a” to allow root user to append some data to our secret file but root won’t be allowed to overwrite the file.

[root@node1 ~]# chattr +a /tmp/deepak/secret_file

Check the assigned attributes and as you see now we have “a” also assigned to our secret_file

[root@node1 ~]# lsattr /tmp/deepak/
-----a-------e-- /tmp/deepak/secret_file

Next try to append some data to this file

[root@node1 ~]# echo "I am appending some more content" >> /tmp/deepak/secret_file

Looks like it worked as expected, verify the same

[root@node1 ~]# cat /tmp/deepak/secret_file
This is a secret file
I am appending some more content

So, as you see now our secret file has some more content.

Let us try to overwrite the data

[root@node1 ~]# echo "I am trying to overwrite the content" > /tmp/deepak/secret_file
-bash: /tmp/deepak/secret_file: Operation not permitted

As expected the extended attributes didn’t allowed me to overwrite the data.

Make the file immutable (restrict all activity)

Now let us make the file immutable so no change at all can be made to this file.

[root@node1 ~]# chattr +i /tmp/deepak/secret_file

Check the applied attributes

[root@node1 ~]# lsattr /tmp/deepak/secret_file
----ia-------e-- /tmp/deepak/secret_file

As you see both “a” and “i” are applied to our secret file but since “i” serves our purpose we do not need “a” here so we will remove the “a” attribute

[root@node1 ~]# chattr -a /tmp/deepak/secret_file

Next verify the applied attributes again

[root@node1 ~]# lsattr /tmp/deepak/secret_file
----i--------e-- /tmp/deepak/secret_file

Next I will try to overwrite the data of this file and will also attempt to remove this file

[root@node1 ~]# echo "I am trying to overwrite the content" > /tmp/deepak/secret_file
-bash: /tmp/deepak/secret_file: Permission denied

[root@node1 ~]# rm -f /tmp/deepak/secret_file
rm: cannot remove ‘/tmp/deepak/secret_file’: Operation not permitted

But as you see due to the extended attributes the system does not allows root user to perform any activity on this file.

Instead of file you can also apply these attributes at directory level to protect all the files under the respective directory.

Remove extended attributes

To remove an extended attributes as I also showed in above step use minus sign along with the option

# chattr -a <file/directory>
# chattr -i <file/directory>

Lastly I hope the steps from the article to prevent or restrict root user access on files and directories on Linux was helpful. So, let me know your suggestions and feedback using the comment section.

https://www.golinuxcloud.com/restrict-root-directory-extended-attributes/