Root Can't Delete It: Immutable and Append-Only Files

A web host was compromised, and /root/case/srv is a working copy of its config tree. Two people had been at it with chattr before you: an admin pinning files, and the intruder protecting what they planted. So some files here refuse to change even for root, and ls -l won't tell you which. The permission bits look ordinary. The refusal comes from inode attributes, a layer below permissions.

/root/case/brief.txt has the details and /root/case/assignment.env names your files (they differ per session):

1. Triage first. Before you change anything, record every file under /root/case/srv that carries the immutable (i) or append-only (a) attribute in /root/case/attributes.txt, one path per line.

2. Clean up. Remove the intruder's cron job from srv/etc/cron.d, and only that file.

3. Harden. Pin the critical file so nothing, root included, can change, rename or delete it.

4. Tamper-evidence. Make the named log append-only without losing a byte of what it already holds.

5. Redact. A log leaked a database password. Replace it in place, and leave that log's attributes as you found them.

Grading reads the files and their attributes with lsattr, not your commands, so any route that ends in the right state passes.