(rsadowski.de)

134 points todsacerdoti | 2 comments | 18 Jul 25 08:36 UTC | HN request time: 0.416s | source

Show context

eternauta3k ◴[18 Jul 25 09:46 UTC] No.44602844[source]▶

>>44602532 (OP) #

Is root prevented from directly writing to the underlying block device?

replies(1): >>44602848 #

1. kstrauser ◴[18 Jul 25 09:46 UTC] No.44602848[source]▶

>>44602844 #

Yes.

replies(1): >>44603011 #

2. messe ◴[18 Jul 25 10:11 UTC] No.44603011[source]▶

>>44602848 (TP) #

Only if securelevel is 2. If securelevel = 1, then only mounted filesystems are RO. An attacker could conceivably forcibly unmount /var/log as root, and make the changes directly to the block device.

↑

When root meets immutable: OpenBSD chflags vs. log tampering