Subject: secure levels
To: None <netbsd-help@netbsd.org>
From: Wenchi Liao <wliao@midway.uchicago.edu>
List: netbsd-help
Date: 08/26/1999 11:30:43
Random questions about secure levels.
In init(8), the advice is to always run in level 0 for single
user, and level 1 for multi-user.
init(8) goes on:
1 Secure mode - system immutable and system append-only flags may not
be turned off; disks for mounted filesystems, /dev/mem, and
/dev/kmem are read-only.
If disks for mounted filesystems are read-only, isn't it a
bit pointless to run it in multi-user mode where people may
need to write to the disk?
If I compile a kernel w/o insecure (or set the secure level
to 0 in rc.conf), it seems I can write to the disk anyway.
What I can't do, however, is start xdm in multi-user mode.
(Rebooting has wiped the log, but the error message was
something about the server being unable to access memory at
address 0xNNNNNNNN.)
If anything, level 0 seems ideal for multi-user:
0 Insecure mode - immutable and append-only flags may be changed.
All devices may be read or written subject to their permissions.
Can somebody please explain the logic/reasoning behind
this.
WL