lsattr

What it does

How to write it

lsattr [-RVadlpv] [FILE]...

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Attributes of one file

   $lsattr /etc/resolv.conf
   ---------------------- /etc/resolv.conf

   No attributes set.

2. 2Long names

   #lsattr -l /var/log/app/audit.log
   /var/log/app/audit.log       Append_Only

   Easier to read.

3. 3A directory itself

   $lsattr -d /srv/archive

   Without -d you see the files inside.

4. 4All files, also hidden ones

   $lsattr -a ~

   Includes .bashrc and others.

5. 5Search a tree for immutable files

   #lsattr -R /etc 2>/dev/null | grep -- '-i-'

   Explains failing updates or config tools.

6. 6Check SSH files for attacker tricks (security)

   #lsattr /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys

   i on authorized_keys can hide a backdoor key.

7. 7Check before a package update

   #lsattr /usr/bin/* 2>/dev/null | grep -v -- '^-*e*-* '

   Any attribute other than e (extents) is unusual in /usr/bin.

8. 8Show the project number

   #lsattr -p /srv/projects

   Used with project quotas on ext4/XFS.

9. 9Compare with ls

   $ls -l /etc/resolv.conf; lsattr /etc/resolv.conf

   ls shows the mode; lsattr shows the attributes.

10. 10Errors on special files

    $lsattr /dev/null
    lsattr: Operation not supported While reading flags on /dev/null

    Only normal files and folders have attributes.

Nothing matches this filter.

Exit codes