Re: Why Ext2/3 needs immutable attribute?

From: Willy TARREAU (willy_at_w.ods.org)
Date: 04/17/05

  • Next message: TJ: "via82xx driver: reporting dxs_support experience" 
    Date:	Sun, 17 Apr 2005 18:27:07 +0200
To: Xin Zhao <uszhaoxin@gmail.com>

    On Sun, Apr 17, 2005 at 12:12:13PM -0400, Xin Zhao wrote:
    > Thanks for your reply.
    >
    > Yes. I know, with immutable, even root cannot modify sensitive
    > files. What I am curious is if an intruder has root access, he may
    > have many ways to turn off the immutable protection and modify files.
    > So immutable is designed just to prevent a valid root from making
    > silly mistakes?

    Probably yes, but it also provides a first level of security :
      - if the intruder launches programs blindly, he will not systematically
        get write access. Eg: if he abuses a CGI to call things like
          echo r00t::0:0::/:/bin/sh >>/etc/passwd
        it will not work.

      - if you give root access to other people on your file-system but you
        don't give them the CAP_LINUX_IMMUTABLE capability, they will not be
        able to modify the protected files. Useful when those files are the
        ones you use to grant them access ;-)

    Regards,
    Willy

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

  • Next message: TJ: "via82xx driver: reporting dxs_support experience"

    Relevant Pages

    • Re: Why Ext2/3 needs immutable attribute?
      ... What I am curious is if an intruder has root access, ... have many ways to turn off the immutable protection and modify files. ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • Re: Why Ext2/3 needs immutable attribute?
      ... What I am curious is if an intruder has root access, ... all holes and secure it correctly without additional ptches like SELinux)) ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • Re: getaffinity/setaffinity and cpu sets.
      ... The notion would be that you can create a new numbered cpuset with cpuset. ... You can modify or inspect its affinity with get/setaffinity above and the CPU_WHICH_SET argument. ... This set would not be modifiable by user processes or by processes in a jail. ... Another option would be to expel the offending thread from the set that is in violation and reparent it to the real system root along with a syslog message or similar. ...
      (freebsd-arch)
    • Re: NIS with local root
      ... Yes - root can still su to the user and then modify the files using the ... Our liability is limited to ... re-supplying any affected attachments. ...
      (Focus-Linux)
    • Re: Spoofing file information?
      ... > if the intruder gained root access to your system, couldnt he remount the file system's in rw mode, and modify the binary, or does freebsd prevent that from occuring. ... > no, seriously, you generally check if two files are the same by using an md5 hash or the cksum command. ... An intruder doesn't 'spoof' file sizes, he replaces binaries such as ls and netstat so they hide his system modifications. ...
      (FreeBSD-Security)