| |||||||||||
|
| |||||||||||
OpenBSD 3.5: a peek at another free UnixOpenBSD 3.5: a peek at another free UnixPosted May 6, 2004 7:37 UTC (Thu) by ekj (guest, #1524)Parent article: OpenBSD 3.5: a peek at another free Unix So, what stops the attacker who has gained root from, for example, unmounting the filesystem, change the flag in the filesystem by accessing the hd-partition directly, and then remounting the filesystem ? Doesn't even need to be hard, sounds rather simple to write a script that does this automatically. Doesn't having to reboot for every trivial security-patch (as would probably be needed if you make /bin or any other big part of the tree immutable) get kinda annoying, especially where people depend on the services the box provide ?
(Log in to post comments)
OpenBSD 3.5: a peek at another free Unix Posted May 6, 2004 8:51 UTC (Thu) by eru (subscriber, #2753) [Link] So, what stops the attacker who has gained root from, for example, unmounting the filesystem, change the flag in the filesystem by accessing the hd-partition directly, and then remounting the filesystem ?This is where the securelevels come in. At higher securelevels, nobody, not even root, can access the disk directly. Have not used this myself, but read this from the "Absolute FreeBSD" book (FreeBSD has the same features).
|
|||||||||||