0

I'm trying to make my linux system secure.

So I'm considering if I can remove the w permission for all of binary files, such as ls, pwd etc. For now they are all -rwxr-xr-x root root, can I remove w for root as owner?

  • 4
    What difference would it make? To edit the file, you would need root access, and if you had root access, you can just add back the write permissions. – muru Jan 30 '18 at 1:53
  • 2
    You probably do not want to remove the write permission for the root user. During upgrades, installed programs, libraries, configuration files are overwritten or modified... removing the write permission will definitely cause headaches. – RubberStamp Jan 30 '18 at 1:57
  • @RubberStamp: Definitely?  What’s your basis for saying that?  Root can overwrite any plain file, even if it’s protected 444 or 555. – G-Man Jan 30 '18 at 4:20
2

Executable files shouldn't need 'w' permission to run - that is the purpose of the 'x' permission.

But, I don't think what you're trying to do is going to work. If someone can gain root access to your system, then they will have the power to do anything, regardless of whether the file owner has 'w' permission or not. The root user always has 'rw' access to all files on the system.

There may be some things you can do to protect your data though:

https://superuser.com/questions/698404/how-can-i-prevent-access-to-my-home-directory-from-another-root-user

  • Not to mention that changing the permissions on e.g. sudo will automatically remove the suid bit (unless you explicitly re-add it), which will cause all sorts of other problems. – Wildcard Jan 30 '18 at 2:46
  • Doing a global chmod 555 would surely be a disaster, but chmod u-w will turn off the owner write bit without affecting suid. – G-Man Jan 30 '18 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.