kernel securelevels

kernel securelevels

Posted Feb 25, 2005 17:16 UTC (Fri) by ecashin (subscriber, #12040)
Parent article: Debian vs. FreeBSD as a Web Serving Platform, Part 1

I've always considered the kernel securelevels
feature of FreeBSD to be the most significant
difference between, e.g., debian and FreeBSD
for a host like a web server.

By going into a higher securelevel, it's possible
to make files truly immutable. That is, no user,
not even root, can modify files that have the
immutable flag set. And the immutable flag can't
be unset. That means you can set up the server
such that trojaning its system programs (like login
and ls) becomes impossible.

Linux has some features aimed at providing this
level of security, but I've been waiting for
them to come together in a usable way for a while.

---

(Log in to post comments)