On my domain controllers (where I absolutely cannot have anyone touching the conf), I just chattr +i /etc/resolv.conf.
That prevents anything, even root, from changing the file, unless chattr -i is called first.
That prevents anything, even root, from changing the file, unless chattr -i is called first.
Apparently, they are very file system specific. That's why they are not widely used. I guess a chmod 0444 would not do it, as system tools tend to "fix" wrong permissions automatically (but not permissive attributes).