I'm looking for a way to protect certain folders from any manipulation and write attempts (also from the root user as with macOS). I've already looked for options, but I haven't found anything useful. Any possibility such as adding the immutable attribute to a folder can easily be bypassed by the root user with chattr -i. And creating a separate partition that is mounted as read-only is not an option for my use case, because I only want to protect certain folders in the file system like /bin but also files like /etc/httpd/conf/httpd.conf.
Add a comment
|
2 Answers
You cannot protect yourself from a rogue root user. By definition it has full access to the system, including the ability to load/unload kernel modules, modify the kernel memory, etc. etc. etc.
If you're looking for a way to protect the system against yourself, I've no idea, I'm not sure it's possible.
If you want to secure the system, make sure no one but you can access root, that's it.
answered Jan 21, 2022 at 10:48
While within the traditional Unix permission model (Discretionary access control, DAC) the root user is all-powerful and can't be restricted from accessing certain files you still can restrict even the root by using SELinux to implement Mandatory Access controls MAC. For actual implementation see a blog post by Sven Vermeulen Restricting even root access to a folder.
