From owner-freebsd-security Sun Oct 17 12: 9: 5 1999 Delivered-To: freebsd-security@freebsd.org Received: from dt050n71.san.rr.com (dt050n71.san.rr.com [204.210.31.113]) by hub.freebsd.org (Postfix) with ESMTP id 265FD14BD3 for ; Sun, 17 Oct 1999 12:08:41 -0700 (PDT) (envelope-from Doug@gorean.org) Received: from gorean.org (master [10.0.0.2]) by dt050n71.san.rr.com (8.9.3/8.8.8) with ESMTP id MAA09819; Sun, 17 Oct 1999 12:06:21 -0700 (PDT) (envelope-from Doug@gorean.org) Message-ID: <380A1E2C.CCA326F5@gorean.org> Date: Sun, 17 Oct 1999 12:06:20 -0700 From: Doug Organization: Triborough Bridge & Tunnel Authority X-Mailer: Mozilla 4.7 [en] (X11; I; FreeBSD 4.0-CURRENT-0927 i386) X-Accept-Language: en MIME-Version: 1.0 To: Justin Wells Cc: Antoine Beaupre , Mike Nowlin , "Rashid N. Achilov" , freebsd-security@FreeBSD.ORG Subject: Re: kern.securelevel and X References: <14343.23571.679909.243732@blm30.IRO.UMontreal.CA> <19991017012750.A812@fever.semiotek.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Justin Wells wrote: > The problem with securelevel, in my mind, is that an attacker who > got root would simply write stuff into the /etc/rc scripts and then > force the machine to reboot. > > It would be very difficult to set the schg flag on every possible > file that gets run as root during bootup. > > Does anyone have any clever solutions? Mount / read only. Doug -- "Stop it, I'm gettin' misty." - Mel Gibson as Porter, "Payback" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message