Password protecting a system file? (e.g. /etc/resolv.conf)

Question

I am trying to parental control myself by restricting web access via OpenDNS. The OpenDNS account password will be handed to someone trustworthy. Now, I want to put some restriction on the /etc/resolv.conf, perhaps using a key or password, but not the root password. Also I do not want to compromise the accessibility by the kernel. Is this possible?

Answer 1

No, not the way you're trying to do it. Root has access to every file on the system. You can make it harder to modify the file (note: it has to be publicly readable), but if you have root access, you can't prevent yourself from modifying it.

There is no password protection feature for files. Even if there was one, being root, you could remove it. (You can encrypt a file, but that makes it unreadable.)

One way to make it harder to modify the file is to set the immutable attribute: chattr +i /etc/resolv.conf. Then the only way to modify it will involve running chattr -i /etc/resolv.conf. (Or going to a lower level and modifying the disk content — with a very high risk of erasing your data if you do it wrong.)

If you want to put a difficult-to-bypass filter on your web browsing, do it in a separate router box. Let someone else configure it and don't let them give you the administrator password.

Answer 2

The OpenDNS account password will be handed to someone trustworthy.

Ok. You want a non-root user to be able to make limited changes.

You can do this:

1. Create a new group, e.g. "OpenDNS".
2. chgrp OpenDNS /etc/resolv.conf
3. chmod g+rw /etc/resolv.conf
4. Add the trusted user to the "OpenDNS" group.

This assumes that permissions on /etc/resolv.conf are not policed by some other part of your system.