4 ms·
On my domain controllers (where I absolutely cannot have anyone touching the conf), I just chattr +i /etc/resolv.conf. That prevents anything, even root, from
by amaccuish 8y ago
On my domain controllers (where I absolutely cannot have anyone touching the conf), I just chattr +i /etc/resolv.conf.
That prevents anything, even root, from changing the file, unless chattr -i is called first.
- ktpsns 8y agoWow, I wasn't aware of the chattr command at all. Here is a list of available: https://en.wikipedia.org/wiki/Chattr https://en.wikipedia.org/wiki/Chattr Apparently, they are very file system specific. That's why they are not widely used. I guess a chmod 0444 would not do it, as system tools tend to "fix" wrong permissions automatically (but not permissive attributes).
- deleted 8y ago[deleted]
- j7k6 8y agoI use `chattr +i` with NFS mountpoints for backups, it prevents the local harddrive from filling up when a network share fails to mount on boot.
- muxator 8y agoTotally. If something is meant to be a mount point, a chattr +i on the underlying directory is a godsend, because it gives you an immediate error in case the mount should fail for whatever reason.
- larkeith 8y agoYou might be able to do it in a more system-agnostic manner with SELinux.
- cyphar 8y agoThat would be less system-agnostic because you have to be running with SELinux as the LSM. The immutable attribute is supported on almost all filesystems.