Messages in this thread | | | From | sct@dcs ... | Date | Thu, 28 Mar 96 22:50 GMT | Subject | Re: ext2 attribute immutable |
| |
Hi,
On Thu, 21 Mar 1996 19:06:48 -0500, Todd Graham Lewis <tlewis@mindspring.com> said:
> On Thu, 21 Mar 1996, Theodore Ts'o wrote: >> This is intentional. Otherwise, even if someone made /etc/passwd >> immutable, you could bypass the security by moving /etc/passwd out of >> the way and creating a new, modified file. >> - Ted
> I have been curious about this, as I had until a week ago received > tauntings from BSDers about Linux's lack of immutable.
> I don't want to kludge the list, so is there:
> 1) any documentation? (this would be in the ext2 kernel code?)
Sort of. The immutable flag is documented in the e2fsprogs maintained by Ted, and has been around for a long time. It's a perfectly standard component of Linux. However, to be *really* secure you need a way to prevent even root from overcoming the immutable flag. The way to do that is to have a global system-wide security level. The system boots in singleuser mode with securelev=0, but root may up the securelev at any time. A non-zero securelev prevents even root from bypassing or removing the immutable (or the append-only) flag on an ext2 file.
Not even root is allowed to decrease the securelev again. The only process ever allowed to decrement securelev is init.
Only since somewhere around 1.3.6x was securelev properly implemented. So, although immutable flags have been around for ages, they have only recently become functional.
> 2) someone willing to be pestered privately with a few questions?
Sure.
Cheers, Stephen. -- Stephen Tweedie <sct@dcs.ed.ac.uk> Department of Computer Science, Edinburgh University, Scotland.
| |