Subject: secure levels
To: None <netbsd-help@netbsd.org>
From: Wenchi Liao <wliao@midway.uchicago.edu>
List: netbsd-help
Date: 08/26/1999 11:30:43
Random questions about secure levels.

In init(8), the advice is to always run in level 0 for single
user, and level 1 for multi-user.

init(8) goes on:
1     Secure mode - system immutable and system append-only flags may not
      be turned off; disks for mounted filesystems, /dev/mem, and
      /dev/kmem are read-only.

If disks for mounted filesystems are read-only, isn't it a
bit pointless to run it in multi-user mode where people may
need to write to the disk?

If I compile a kernel w/o insecure (or set the secure level
to 0 in rc.conf), it seems I can write to the disk anyway.
What I can't do, however, is start xdm in multi-user mode.
(Rebooting has wiped the log, but the error message was
something about the server being unable to access memory at
address 0xNNNNNNNN.)

If anything, level 0 seems ideal for multi-user:
0     Insecure mode - immutable and append-only flags may be changed.
      All devices may be read or written subject to their permissions.

Can somebody please explain the logic/reasoning behind
this.

WL