On 11/29/05, James Wilkinson <fedora@xxxxxxxxxxxxxxxxxxx> wrote: > preeti malakar wrote: > > Why is the immutable bit of all system binaries viz files in /sbin, /bin, /usr > > not set, so that none can change or delete them? > > As Paul said, that would stop yum and rpm from upgrading those programs > (say if the immutable binary has a security bug). Also that would cause the prelink cronjob to fail...since it does intentionally modify files. There's nothing of course to keep you from setting the immutable bit. And if you're building a super hardened system perhaps you should. It's just an extra layer beyond POSIX file permissions, mount options (mounting /usr read-only) and perhaps SELinux. But you must be prepared for things like rpm/yum or prelink to fail. But I don't think this should be the default since it would confuse the heck out of most administrators, and scripts as well. -- Deron Meranda
