lsattr

Display the attributes of the files in the current directory

$ lsattr

$ lsattr [path]

$ lsattr -R

$ lsattr -a

$ lsattr -d

lsattr [options] [files...]

-R
    Recursively list attributes of directories and their contents.

-a
    List all files in directories, including those starting with '.' (hidden files) and the '.' and '..' entries.

-d
    List attributes of directories themselves, rather than their contents.

-v
    Display the file's version/generation number.

-j
    Display the ext3/ext4 journal status for files. This option is specific to these filesystems.

-l
    Use long flag names instead of single-character abbreviations (e.g., 'immutable' instead of 'i').

-V
    Display the version information for lsattr and exit.

files...
    One or more files or directories whose attributes are to be listed. If none are specified, the current directory's contents are listed.

lsattr is a command-line utility in Linux used to list the extended attributes of files and directories on filesystems, primarily ext2, ext3, and ext4. These attributes, often referred to as file attributes or i-node flags, are distinct from standard file permissions and are managed by the chattr command. They provide a finer grain of control over how files can be accessed or modified by the kernel. For example, attributes can make a file immutable ('i'), append-only ('a'), or prevent its modification even by the root user, enhancing security and data integrity.

The output of lsattr shows a string of characters, where each character represents a specific attribute (e.g., 'i' for immutable, 'a' for append-only). Understanding these attributes is crucial for system administrators to manage system integrity, prevent accidental deletions, or optimize filesystem performance. It's an essential tool for auditing file properties beyond standard permissions.

lsattr primarily operates on ext2, ext3, and ext4 filesystems, where these i-node attributes are natively supported and managed. While some other filesystems (like XFS, Btrfs) might expose a limited set of these attributes via compatibility layers, their behavior may vary or not be fully supported.

It's crucial to distinguish these i-node attributes from general extended attributes (xattrs) which are managed by commands like getfattr and setfattr. lsattr deals specifically with kernel-level file flags that control fundamental file behaviors, often related to security and integrity, rather than arbitrary user-defined metadata. Root privileges are often required to change some of these attributes, and certain attributes (like 'i' for immutable) can prevent even root from modifying or deleting a file.

The output of lsattr typically shows a string of characters, each representing a specific attribute. Below are some of the most common ones:
a: Append-only - a file can only be opened in append mode for writing.
i: Immutable - a file cannot be modified, deleted, renamed, or linked. Not even by the root user.
A: No atime updates - suppresses updates to the file's last access time, useful for performance on frequently accessed files.
d: No dump - a file will not be considered for backup by the dump utility.
S: Synchronous updates - changes to the file are written to disk synchronously.
s: Secure deletion - when the file is deleted, its blocks are zeroed out (not commonly implemented).
u: Undeletable - a file cannot be deleted (reserved for future use, not commonly implemented).
D: Synchronous directory updates - for directories, changes are written to disk synchronously.
e: Extent format - file uses extents for mapping data blocks (default on ext4).

lsattr is a core utility within the e2fsprogs package, a collection of userspace utilities for managing the ext2, ext3, and ext4 filesystems in Linux. Its development is deeply intertwined with the evolution of these filesystems, which were primarily developed by Theodore Ts'o. As ext filesystems became the standard for Linux, tools like lsattr and chattr became essential for system administrators to leverage the advanced file attribute capabilities offered by the kernel, allowing for stricter control over file integrity and system security.

chattr(1), getfattr(1), setfattr(1), stat(1), e2fsck(8)