Unable to change file attributes (e.g. immutable) on /etc/resolv.conf

I noticed that the network manager frequently changed my DNS server, so I wanted to set the immutable bit on the /etc/resolv.conf file, which didn't work. I noticed that the /etc/resolv.conf file is actually a symbolic link to /run/resolvconf/resolv.conf.

Now, sudo chattr +i /run/resolvconf/resolv.conf results in:

chattr: Inappropriate ioctl for device while reading flags on /run/resolvconf/resolv.conf

From what I can tell, this means that /run/resolvconf/ doesn't support such attributes. Is that right?

Xubuntu 15.10;

How can I write-protect my resolv.conf file?

2 Answers

/run is a tmpfs (ramdisk) filesystem, and doesn't support extended attributes:

% df -T /run
Filesystem Type 1K-blocks Used Available Use% Mounted on
tmpfs tmpfs 393016 6416 386600 2% /run

On how to avoid /etc/resolv.conf being changed by NetworkManager, I found a possible solution at the Arch Linux forums.

Create a resolv.conf file containing the settings you wish to keep somewhere in your system (say in /etc/resolv.conf.DNSoverride) and put this script in /etc/NetworkManager/dispatcher.d:

#! /bin/sh
cp -f /etc/resolv.conf.DNSoverride /etc/resolv.conf

The script, quoting man networkmanager:

[...] should be a regular executable file owned by root. Furthermore, it must not be writable by group or other, and not setuid. [...]

Quoting man networkmanager:

[...] NetworkManager will execute scripts in the /etc/NetworkManager/dispatcher.d directory or subdirectories in alphabetical order in response to network events. [...]

This means that the script will copy /etc/resolv.conf.DNSoverride overwriting /etc/resolv.conf each time a network event takes place, overriding possible changes made to /etc/resolv.conf.

This answer addresses some concerns in the answer by kos.

Because /etc/resolv.conf is a symlink, overriding it directly can cause an error when resolvconf -u is automatically run.

First, create your replacement resolv.conf.override as below. This is intended to replace resolv.conf. Match the permissions and owner as below:

$ ll /etc/resolv.conf.override
-rwxrwxrwx 1 root root 172 Jun 26 20:38 resolv.conf.override*

Next, create a script such as 20-resolv-conf-override. Match the permissions and owner as below.

$ cd /etc/NetworkManager/dispatcher.d
$ ll 20-resolv-conf-override
-rwxr-xr-x 1 root root 101 Jun 26 20:45 20-resolv-conf-override*
$ cat 20-resolv-conf-override
#!/bin/sh
cp -f /etc/resolv.conf.override /run/resolvconf/resolv.conf
$ sudo ln -f 20-resolv-conf-override ./pre-up.d/

Scripts in dispatcher.d run when NetworkManager is re/started. In contrast, scripts in dispatcher.d/pre-up.d effectively run when the system is re/started. Both are needed.