On Sun, Apr 17, 2005 at 12:12:13PM -0400, Xin Zhao wrote:
> Thanks for your reply.
>
> Yes. I know, with immutable, even root cannot modify sensitive
> files. What I am curious is if an intruder has root access, he may
> have many ways to turn off the immutable protection and modify files.
> So immutable is designed just to prevent a valid root from making
> silly mistakes?
Probably yes, but it also provides a first level of security :
- if the intruder launches programs blindly, he will not systematically
get write access. Eg: if he abuses a CGI to call things like
echo r00t::0:0::/:/bin/sh >>/etc/passwd
it will not work.
- if you give root access to other people on your file-system but you
don't give them the CAP_LINUX_IMMUTABLE capability, they will not be
able to modify the protected files. Useful when those files are the
ones you use to grant them access ;-)
Regards,
Willy
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
