Subject: security/9359: there should be a script to set system files immutable
To: None <firstname.lastname@example.org>
From: Erik E. Fair <email@example.com>
Date: 02/06/2000 14:59:22
>Synopsis: there should be a script to set system files immutable
>Responsible: security-officer (NetBSD Security Officer)
>Arrival-Date: Sun Feb 6 14:57:00 2000
>Originator: Erik E. Fair
International Organization of Internet Clock Watchers
>Release: 1.5 and later, maybe
System: NetBSD digital.clock.org 1.4.2_ALPHA NetBSD 1.4.2_ALPHA (DIGITAL) #10: Mon Jan 10 22:38:56 PST 2000 firstname.lastname@example.org:/usr/obj/sys/arch/alpha/compile/DIGITAL alpha
There should be a script available which can "lock down"
the installed default system using chflags(8) to set critical
system files, binaries, etc to "system immutable."
While this makes changing the system while running a very
painful process, it can frustrate a system attacker who
gains root access, only to find that the system must be
brought down to single user mode in order to modify system
This implies creating and maintaining a list of files which
are not supposed to change between NetBSD releases (e.g.
/sbin/init), and possibly an additional list of files which
are not supposed to change after installation (e.g. /netbsd,
/etc/rc.conf). Some of it will be MD (e.g. bootstrap files).
Perhaps this is something that mtree(8) should take care of.