File Attributes

All files in Unix like systems have file attributes. The most common file attributes include information such as ownership (user and group owners), timestamps (file creation, modification and access times), permissions (such as the file mode, or SELinux labels).

In addition to these, there are additional filesystem-specific file attributes that enable filesystem-specific behaviors and features.

Introduction

Basic Linux file attributes can be listed using the stat utility:

# stat /some/file
  File: ‘/some/file’
  Size: 13857688196     Blocks: 27066368   IO Block: 16777216 regular file
Device: 2dh/45d Inode: 12331       Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:unlabeled_t:s0
Access: 2018-09-06 17:30:48.650399353 -0600
Modify: 2018-09-01 22:26:44.904672188 -0600
Change: 2020-06-11 15:53:36.225415501 -0600
 Birth: -

EXT filesystem attributes

On EXT based filesystems, you can list filesystem file attributes using the lsattr command:

$ lsattr
--------------e------- ./Templates
--------------e------- ./Downloads
--------------e------- ./Projects
--------------e------- ./Documents
--------------e------- ./Desktop
--------------e------- ./Music
--------------e------- ./Public
--------------e------- ./Videos
--------------e------- ./Pictures

Here are some common ext filesystem attributes. You can read more from the chattr man page.

Attribute	Description
a	Content can be only appended
c	File contents are compressed by the kernel when written and decompressed when read.
i	Contents cannot be modified, deleted or renamed (immutable)
s	Content automatically zeroed when deleted
j	Content data will be written to the filesystem journal first.

Modifying Unix file attributes

Use the following tools to modify the following types of Unix attributes.

Modify...	Utility	Example
Permission (access modes)	chmod <permission>	# chmod 644 file.dat # chmod u+rw file.dat
Ownership	chown / chgrp	## Both # chown user:group file.dat ## Or individually # chown user file.dat # chgrp group file.dat
SELinux Context	chcon -R <context>	# chcon -R unconfined_u:object_r:user_home_t:s0 /home/user/.ssh/
File Access Time	touch -a -t YYYYMMDDhhmm.ss	## Set access time to Dec 26 2020 at 1:30:30PM # touch -a -t 202012261330.30 /some/file ## Set a file based on a reference file # touch -a -r reference.ext target.ext
File Modify Time	touch -m -t YYYYMMDDhhmm.ss	## Set modification time to Dec 26 2020 at 1:30:30PM # touch -m -t 202012261330.30 /some/file ## Set a file based on a reference file # touch -m -r reference.ext target.ext
File Change Time	N/A	You can't change a file's ctime. If you absolutely need to, you can try these options: Set the system clock and then touch the file. debugfs -w -R 'set_inode_field /tmp/foo ctime 201001010101' /dev/sda1, then echo 2 > /proc/sys/vm/drop_caches
EXT attributes Immutable file	chattr +ior to remove: chatt -i	## Make the file immutable # chattr +i no-touching # rm -f no-touching rm: cannot remove 'no-touching': Operation not permitted ## Undo that # chattr -i no-touching

Tasks and how-tos

How to copy over file ownerships and attributes

If you copied a set of files without preserving any of the attributes but want to preserve the attributes, you have two options:

1. Run rsync with the -a archive option. Rsync should be smart enough to detect the files have identical contents and only update its file attributes without doing a full copy again.
2. Manually 'sync' the attributes using a combination of touch, chown, and chmod with the --reference option. If you're in a rut like I was after recovering data from a tape, you can do something like this:

#!/bin/bash

# Replace files here to the root filesystem, but preserving timestamps
# Eg.  ./etc/fstab gets copied to /etc/fstab, but with timestamps, permissions retained.
find | while read i ; do
        if [ -f $i ] ; then
               touch -a -m -r /$i $i
               chown -v --reference /$i $i
               chmod -v --reference /$i $i

                # Replace source with the local copy I have here
                rm -v /$i
                mv -v $i /$i
        fi
done