>Number:         9359
>Category:       security
>Synopsis:       there should be a script to set system files immutable
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    security-officer (NetBSD Security Officer)
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sun Feb  6 14:57:00 2000
>Last-Modified:
>Originator:     Erik E. Fair
>Organization:
International Organization of Internet Clock Watchers
>Release:        1.5 and later, maybe
>Environment:
	
System: NetBSD digital.clock.org 1.4.2_ALPHA NetBSD 1.4.2_ALPHA (DIGITAL) #10: Mon Jan 10 22:38:56 PST 2000 fair@doomsday.clock.org:/usr/obj/sys/arch/alpha/compile/DIGITAL alpha


>Description:
	There should be a script available which can "lock down"
	the installed default system using chflags(8) to set critical
	system files, binaries, etc to "system immutable."

	While this makes changing the system while running a very
	painful process, it can frustrate a system attacker who
	gains root access, only to find that the system must be
	brought down to single user mode in order to modify system
	binaries.

>How-To-Repeat:
	
>Fix:
	This implies creating and maintaining a list of files which
	are not supposed to change between NetBSD releases (e.g.
	/sbin/init), and possibly an additional list of files which
	are not supposed to change after installation (e.g. /netbsd,
	/etc/rc.conf). Some of it will be MD (e.g. bootstrap files).

	Perhaps this is something that mtree(8) should take care of.
>Audit-Trail:
>Unformatted: