Question: I have a requirement to write files to a Linux file system that can not be subsequently overwritten, appended to, updated in any way, or deleted. Not by a sudo-er, root, or anybody. I am attempting to meet the requirements of the financial services regulations for recordkeeping, FINRA 17A-4, which basically requires that electronic documents are written to WORM (write once, read many) devices. I would very much like to avoid having to use DVDs or expensive EMC Centera devices.

Is there a Linux file system, or can SELinux support the requirement for files to be made complete immutable immediately (or at least soon) after write? Or is anybody aware of a way I could enforce this on an existing file system using Linux permissions, etc?

I understand that I can set readonly permissions, and the immutable attribute. But of course I expect that a root user would be able to unset those.

I considered storing data to small volumes that are unmounted and then remounted read-only, but then I think that root could still unmount and remount as writable again. 

I'm looking for any smart ideas, and worst case scenario I'm willing to do a little coding to 'enhance' an existing file system to provide this. Assuming there is a file system that is a good starting point. And put in place a carefully configured Linux server to act as this type of network storage device, doing nothing else. 

After all of that, encryption on the files would be useful too!

Answer: 
You can sort of do this with OpenAFS and read-only volumes. It's a lot of infrastructure to install to make it work however and might not meet the requirements. 

<http://www.openafs.org/>

Basically, there is a writeable volume and one or more read-only copies of the volume. Until you release the writeable volume, the read-only copies are unchangeable to clients. Releasing the volume requires admin privileges.

It seems like any solution would require either specialized hardware or a network file system that duplicates the semantics of specialized hardware.
This is a variation on the "*Infalible backup*" problem and the only way to implement it is with multiple remote worm file systems that use and share checksums and do not have shared physical or administration access. This ensures everything is write once, duplicated, integrity provable, and in the case of a single block being erased, changed or corrupted, recoverable.

Plan9 or it's derivatives may impliment all of the required features. See [Plan9](https://github.com/9fans/plan9port) and [Venti](https://en.wikipedia.org/wiki/Venti)