Solutions to Files/Folders That Cannot Be Deleted in Linux

Preface

Recently our server was attacked by hackers, and the attributes of some files were modified, which made it impossible for us to delete the virus files. At the same time, we were unable to delete them using the root user. Now I’m recording the solution.

Normal deletion

If the file belongs to the current user, you can delete it using the rm command.

rm -rf file.sh

If you cannot delete it, try to delete it as root user. If you cannot delete it, please see the instructions below.

Commands to know

If the normal deletion method does not work, then we need to know the following command to delete

lsattr

The lsattr command is used to display the attributes of a file. It is used as follows

# List the attributes of the file file.sh lsattr file.sh
# List the attributes of all files and folders in the current directory lsattr

Attribute Description

• After the i attribute is set, the file cannot be deleted or renamed, and the connection cannot be written or added. Only the root user can set it.
• After the a attribute is set, the file can only add data, and can neither delete nor modify data. Only the root user can set it.
• A After setting the A attribute, if you access this file or directory, its access time atime will not be modified, which can prevent machines with slow I/O from excessively accessing the disk. This helps on slower computers.
• After the s attribute is set, if the file is deleted, it will be completely deleted from the hard disk.
• After the S attribute is set, the file will be written to the hard disk synchronously (usually asynchronously)
• After the u attribute is set, the data content of the file still exists on the disk after it is deleted, and the file can be retrieved
• e means the file is an executable file

For detailed instructions, please refer to: https://baike.baidu.com/item/chattr/9841067?fr=aladdin

chattr

chattr is used to modify file attributes. Please switch to the root user to use this command. If you are a Ubuntu user, you can add sudo before the command to modify it.

# Add i mark to the file.sh file chattr +i file.sh
# Remove the i mark from the file.sh file chattr -i file.sh
# Add two flags, i and a, to file.sh chattr +ia file.sh
# Remove the two flags i and a from the file.sh chattr -ia file.sh

For detailed operations, please refer to: https://baike.baidu.com/item/chattr/9841067?fr=aladdin

Practical operation

From the above, we know that when the file sets any of the attributes i and a, we cannot delete the file. So we first remove the i and a attributes, and then perform the deletion:

# Remove i, a attributes chattr -ia file.sh
# Check whether the removal is successful lsattr file.sh
# Remove the file rm -rf file.sh

If the file has not been deleted successfully, we need to consider whether the folder to which the file belongs has the i or a attribute set (this is indeed difficult to find)

# Return to the previous level cd ..
# Use the lsattr command directly to list the attributes of all files and folders in the current folder. # Do not use the syntax of lsattr folder, which lists the attributes of the files in the folder.

If the folder is set, perform the removal operation on the folder's attributes, and then delete the files in the folder

Gains

• Although lsattr and chattr were discovered during the virus removal process, by understanding file attributes, we found that we can use file attributes to protect important files from being accidentally deleted in actual work, and ensure that files can be restored after accidental deletion.
• If the operation on the file still has no effect, we can try to solve it from the folder.

Summarize

The above is the full content of this article. I hope that the content of this article will have certain reference learning value for your study or work. If you have any questions, you can leave a message to communicate. Thank you for your support for 123WORDPRESS.COM.