Restrict file access to append only

The chattr utility is written for ext2/ext3/ext4 filesystems. It emits ioctls on the files, so it's up to the underlying filesystem to decide what to do with them. The XFS driver in newer Linux kernels supports the same FS_IOC_SETFLAGS ioctl as ext[234] to control flags such as append-only, but you may be running an older kernel where it doesn't (CentOS?). Try using the xfs_io utility instead:

echo chattr +a | xfs_io test.log

Note that, for XFS like for ext[234], only root can change the append-only flag (more precisely, you need the CAP_LINUX_IMMUTABLE capability).


Do you have permissions to do that? From man 1 chattr:

A file with the `a' attribute set can only be open in append mode for writing. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.