Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to parental control myself by restricting web access via OpenDNS. The OpenDNS account password will be handed to someone trustworthy. Now, I want to put some restriction on the /etc/resolv.conf, perhaps using a key or password, but not the root password. Also I do not want to compromise the accessibility by the kernel. Is this possible?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

No, not the way you're trying to do it. Root has access to every file on the system. You can make it harder to modify the file (note: it has to be publicly readable), but if you have root access, you can't prevent yourself from modifying it.

There is no password protection feature for files. Even if there was one, being root, you could remove it. (You can encrypt a file, but that makes it unreadable.)

One way to make it harder to modify the file is to set the immutable attribute: chattr +i /etc/resolv.conf. Then the only way to modify it will involve running chattr -i /etc/resolv.conf. (Or going to a lower level and modifying the disk content — with a very high risk of erasing your data if you do it wrong.)

If you want to put a difficult-to-bypass filter on your web browsing, do it in a separate router box. Let someone else configure it and don't let them give you the administrator password.

share|improve this answer
    
Separate router box with dd-wrt it is, then. Cost effective and easy solution. Thank you. –  Forethinker Jul 24 '12 at 1:14

The OpenDNS account password will be handed to someone trustworthy.

Ok. You want a non-root user to be able to make limited changes.

You can do this:

  1. Create a new group, e.g. "OpenDNS".
  2. chgrp OpenDNS /etc/resolv.conf
  3. chmod g+rw /etc/resolv.conf
  4. Add the trusted user to the "OpenDNS" group.

This assumes that permissions on /etc/resolv.conf are not policed by some other part of your system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.