Re: Root access

From: Simon Matthews (nobody@devnull.com)
Date: 05/06/02 

From: Simon Matthews <nobody@devnull.com>
Date: Mon, 06 May 2002 20:56:25 GMT

On Mon, 6 May 2002, Luke Vogel wrote:

> LIDS is a very comprehensive package designed to limit what root (and
> _any_ other account for that matter) can do on a file system.
>

While LIDS looks interesting at hardening a system, I suspect that a
determined sysadmin with root access could get around it with only a
little effort.

On a Linux box, I suspect one could:
1. add an extra disk

2. Copy the entire disk (with the protected data) using "dd" from the raw
disk (or partition) device to the new disk.

3. Take the disk to another system that is not running LIDS.

Or:

1. During scheduled downtime, boot the LIDS-protected machine with a
kernel that does not include LIDS.

Simon

Relevant Pages

  • Re: Root access
    ... >>> that a determined sysadmin with root access could get around it ... may be nice for an ISP who is selling "full root ... What is LIDS ... A kernel patch and admin tool to enhance the linux kernel security ...
    (comp.os.linux.security)
  • Re: Directory permissions (keep root out)
    ... >> I work for a research entity which has some software that is not ... You can do it if you run an enhanced kernel such as LIDS. ... can even hide a file/directory/filesystem from root if that is your ...
    (comp.os.linux.security)
  • Re: Root cant delete files
    ... > using the mode +i even root can't change didly on a system. ... that has immutable flag set), so one should mark it for removal in the ... /etc/lids/lids.cap file when using LIDS. ...
    (Focus-Linux)
  • Re: Root access
    ... LIDS is a very comprehensive package designed to limit what root (and ... hides files and file systems. ... "capabilities" depending on your security needs. ...
    (comp.os.linux.security)
  • Re: OT Jam Jar source
    ... can buy them ready cut for pennies. ... Not only are they expensive to buy, but I suspect that in a couple of years they will sell a slightly different size so that the lids don't fit. ... Kilner jars are also annoying for the same reason, try getting rubber seals for jars a few years old ...
    (uk.rec.gardening)