From owner-freebsd-security  Tue Dec 19 12:19: 4 2000
From owner-freebsd-security@FreeBSD.ORG  Tue Dec 19 12:19:01 2000
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82])
	by hub.freebsd.org (Postfix) with ESMTP id A7F9837B402
	for <freebsd-security@freebsd.org>; Tue, 19 Dec 2000 12:19:01 -0800 (PST)
Received: from rfx-64-6-211-149.users.reflexcom.com ([64.6.211.149]) by mailhost01.reflexnet.net  with Microsoft SMTPSVC(5.5.1877.197.19);
	 Tue, 19 Dec 2000 12:17:25 -0800
Received: (from cjc@localhost)
	by rfx-64-6-211-149.users.reflexcom.com (8.11.0/8.11.0) id eBJKJ1i24004;
	Tue, 19 Dec 2000 12:19:01 -0800 (PST)
	(envelope-from cjc)
Date: Tue, 19 Dec 2000 12:19:01 -0800
From: "Crist J. Clark" <cjclark@reflexnet.net>
To: Alfred Perlstein <bright@wintelcom.net>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: Read-Only Filesystems
Message-ID: <20001219121901.C23819@rfx-64-6-211-149.users.reflexco>
Reply-To: cjclark@alum.mit.edu
References: <20001219114936.A23819@rfx-64-6-211-149.users.reflexco> <20001219120953.S19572@fw.wintelcom.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
In-Reply-To: <20001219120953.S19572@fw.wintelcom.net>; from bright@wintelcom.net on Tue, Dec 19, 2000 at 12:09:53PM -0800
Sender: cjc@rfx-64-6-211-149.users.reflexcom.com
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

On Tue, Dec 19, 2000 at 12:09:53PM -0800, Alfred Perlstein wrote:
> * Crist J. Clark <cjclark@reflexnet.net> [001219 11:50] wrote:
> > I was recently playing around with the idea of having a read-only root
> > filesystem. However, it has become clear that there is no way to
> > prevent root from changing the mount properties on any filesystem,
> > including the root filesystem, provided there is no hardware-level
> > block on writing and there is someplace (anyplace) where root can
> > write.
> > 
> > Is that accurate? I guess one must go to a "trusted OS" to get that
> > type of functionality?
> 
> You can trust freebsd. :)
> 
> do some research on "securelevel"

I am familiar with securelevel. Are you suggesting,

  # find -x / -exec chflags schg {} \;

-- 
Crist J. Clark                           cjclark@alum.mit.edu


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message