Re: Root is God? (was: Mutt & tmp files)
On Fri, 16 Nov 2001, Mathias Gygax wrote:
> > well, i thought this is the definition of root.
>
> no. with LIDS you can protect files and syscalls even from root. in my
> setup, root cannot even write to his own home directory.
No, you can't. No matter how you cut it, root can install a new
kernel, sans LIDS and write to his/her home dir.
> my root user can't write to /usr/*, doesn't have any special syscall
> access to change network and firewall settings, can't SETUID/SETGID and
> is really locked like a normal user etc. but... root in this setup is
> useless. you can't do anything that looks like administration. you can
> run the daemons that need root access, but they're limited and can't do
> the full root stuff root usually does.
>
> LIDS basically does protect the kernel from root.
Nothing can protect the kernel from root if root can replace the
kernel. Sure you may have /boot mounted read-only, but that is a
simple remount, or boot into single user mode, or put the kernel
somewhere else, or physically put in a different harddrive. There is
no way, nor any reason why, to setup a system in such a way that the
maintainer of the system cannot maintain it. You cannot completely
lock out root, for if you do, it is no longer root.
Can root physically access the machine? If not, then there is someone
else who would be root.
Thats like saying root doesn't have the root password. It doesn't
matter, root can change the root password.
Reply to: