Re: Root is God? (was: Mutt & tmp files)
On Fri, 16 Nov 2001, Ralf Dreibrodt wrote:
>Hi,
>
>Mathias Gygax wrote:
>>
>> On Fre, Nov 16, 2001 at 08:23:27AM -0800, Micah Anderson wrote:
>>
>> > No, you can't. No matter how you cut it, root can install a new
>> > kernel, sans LIDS and write to his/her home dir.
>>
>> how? replace /boot? this is DENY in my setup. access lilo.conf oder lilo
>> binary? DENY. how do you wanna replace system binaries when LIDS is
>> activated and the memory and any critical file/dir is protected?
>
>you have just another definition of root.
>you mean the user with the id 0. this user is really not able to do
>this.
>but root after my definition can hit the reset-button, put in a cdrom
>and boot from the cdrom.
Actually, in order for some of the C patches to be meaningful (root not
having access to everything), you gotta follow some of the Rainbow book
practices like removal of alternate boot devices and RTVing up nonused
plugs. Trust me, the NSA thought of every objection you can come up with
many years before you thought of them, and covered most of them in the
Rainbow book.
>> > Sure you may have /boot mounted read-only, but that is a
>> > simple remount,
>>
>> no, it's not. it's not mounted, it's DENIed by the kernel. every access
>> on this directory is blocked by the kernel. before anything further
>> happen's.
>>
>> remount or mount ist blocked by IIRC by CAP_SYS_ADMIN. an actived LIDS,
>> you can't mount or umount anything. even as root. everything is blocked.
>
>as long as you booted the "normal" way.
>
>> use crypo filesystems to secure storage.
>
>btw: is there anything similar to the international kernel patch for
>linux 2.4.x?
>
>> of course it's root. who else should it be?
>
>you can simply change the user id of the user root instead, that's
>easier ;-)
>
>bye
>Ralf
>
>
>
--
void hamlet()
{#define question=((bb)||(!bb))}
Who is John Galt? galt@inconnu.isu.edu. that's who!
Reply to: