Re: Root is God? (was: Mutt & tmp files)
Hi,
Mathias Gygax wrote:
>
> On Fre, Nov 16, 2001 at 08:23:27AM -0800, Micah Anderson wrote:
>
> > No, you can't. No matter how you cut it, root can install a new
> > kernel, sans LIDS and write to his/her home dir.
>
> how? replace /boot? this is DENY in my setup. access lilo.conf oder lilo
> binary? DENY. how do you wanna replace system binaries when LIDS is
> activated and the memory and any critical file/dir is protected?
you have just another definition of root.
you mean the user with the id 0. this user is really not able to do
this.
but root after my definition can hit the reset-button, put in a cdrom
and boot from the cdrom.
> > Sure you may have /boot mounted read-only, but that is a
> > simple remount,
>
> no, it's not. it's not mounted, it's DENIed by the kernel. every access
> on this directory is blocked by the kernel. before anything further
> happen's.
>
> remount or mount ist blocked by IIRC by CAP_SYS_ADMIN. an actived LIDS,
> you can't mount or umount anything. even as root. everything is blocked.
as long as you booted the "normal" way.
> use crypo filesystems to secure storage.
btw: is there anything similar to the international kernel patch for
linux 2.4.x?
> of course it's root. who else should it be?
you can simply change the user id of the user root instead, that's
easier ;-)
bye
Ralf
Reply to: