←back to thread

When root meets immutable: OpenBSD chflags vs. log tampering

(rsadowski.de)
134 points todsacerdoti | 3 comments | 18 Jul 25 08:36 UTC | HN request time: 0.711s | source
Show context
johnisgood ◴[18 Jul 25 08:59 UTC] No.44602632[source]▶
It is not the same, but I do use "chattr +i" on a file (which applies the immutable attribute) on Linux to a file that otherwise would have been overwritten by programs that do not give a damn whether I want it to or not, and in my case it was easier to just make that file immutable, mainly: /etc/resolv.conf.
replies(3): >>44602842 #>>44603152 #>>44604893 #
1. mmsc ◴[18 Jul 25 10:38 UTC] No.44603152[source]▶
.bash_history
replies(1): >>44603264 #
2. mzajc ◴[18 Jul 25 10:56 UTC] No.44603264[source]▶
Better yet, `shopt -s 'histappend'` in your .bashrc and `chattr +a .bash_history`. This will still allow bash to add to the history, but it won't be able to trim the file.
replies(1): >>44604988 #
3. mmsc ◴[18 Jul 25 14:27 UTC] No.44604988[source]▶
Yes! And for macOS, `chflags uappnd .bash_history`