On Wed, Apr 20, 2005 at 02:47:53PM -0400, Jason Opperisano wrote:
> i'm guessing you're thinking about how the *BSD's have a concept of
> kern.securelevel, and certain things (like firewall rules) become
> immutable; even by root, at certain levels.
>
> i'm not a kernel programmer, but i can tell you that the linux kernel
> doesn't have anything like kern.securelevel; and without it, i don't
> believe what you're asking for is possible. i'd also figure that
> implementing kern.securelevel in the linux kernel would be beyond the
> scope of what the netfilter developers are responsible for.
after pondering this further (post-post, natch)...i had a thought
(yes--it hurt). you could probably use SELinux to achieve this. the
minimal benefits that others have pointed out, and the overly complex
nature of SELinux probably yields a pretty low benefit/cost ratio,
though.
just a thought...
-j
--
"Peter: Wow, is that really the blood of Christ?
Preacher: Yes, it is.
Peter: Holy crap, that guy must've been wasted 24 hours a day."
--Family Guy
