Mike,
> Can someone tell me how they did it ?
They may have modified the kernel, remounted the filesystem readonly... or
the may have simply set the immutable bit:
ryan:~# touch this
ryan:~# chattr +i this
ryan:~# rm -f this
rm: cannot remove `this': Operation not permitted
ryan:~# lsattr this
----i---------- this
ryan:~# chattr -i this
ryan:~# rm this
see chattr(1) and lsattr(1) for more information.
Cheers,
Ryan
------------------------------------------------------------------------
To unsubscribe email security-discuss-request@linuxsecurity.com
with "unsubscribe" in the subject of the message.
