4 ms·

I routinely make /etc/resolv.conf immutable to avoid anything touching it (not VPNs, just systemd and every other random bit of software). # chattr +i /etc/r

• nousermane 4y ago
  You'd probably want to first check that /etc/resolv.conf is a real file, first. SystemD has a nasty habit of replacing it with a symlink. That prevents "chattr" trick from working.
  • vetinari 4y ago
    1. it is systemd-resolved, not "SystemD" 2. it is not a nasty habit, but a configuration. If you do not want it, you can configure systemd-resolved not to do this. 3. it is for a very good reasons, and there were written pages and pages about the issues, what those are; so when you understand why, you won't reconfigure (2) anyway.
• bravetraveler 4y ago
  ~~Keep in mind that making a file immutable doesn't prevent it from being unlinked. That can be removed and modified all the same~~ If this is a real concern, I'd be more mindful of what's being given privilege. It's atypical to chase - going as far to remove bad actors edit: Wrote this while still half asleep, tested - wrong lol. Keeping to prevent more folly
  • toast0 4y ago
    Something with privilege could usually just remove the immutable flag and then go on and do whatever dumb stuff it wants to do... But they usually don't. My corporate macbook was at its most stable when I had set /etc/hosts immutable and the corporate chef got stuck and nobody yelled at me. Of course, a couple months later I did a mac os update and some corporate spyware interfered with the gpu driver... would have been updated if chef had run in the past three weeks. Whoops.
• Max-Ganz-II 4y ago
  Bloody good idea.