On Thu, Mar 24, 2005 at 03:58:40PM -0500, Chris Stankaitis wrote: > and corrected here) this can not be done on the kernel level in > RHEL/Fedora, I can chattr a log append only but any root user can take > the flag off, clean up the stuff in the log they don't want seen and > re-chattr the file. SELinux allows you to write rules to do this > I know on BSD variants you can set this on an OS level, thus to subvert > the logs you would need to reboot, change the setting, do your dirty Or a kernel security hole in either. > If there is no 2.4 kernel solution, is there a 2.6/selinux solution to > my problem? that would not allow anyone (even root) to do anything but > append to logs? You also have to give up X and a few other serivces (as with BSD) but yes you can do it
