On Thu, Mar 24, 2005 at 03:58:40PM -0500, Chris Stankaitis wrote:
and corrected here) this can not be done on the kernel level in
RHEL/Fedora, I can chattr a log append only but any root user can take
the flag off, clean up the stuff in the log they don't want seen and
re-chattr the file.
SELinux allows you to write rules to do this
I know on BSD variants you can set this on an OS level, thus to
subvert
the logs you would need to reboot, change the setting, do your dirty
Or a kernel security hole in either.
If there is no 2.4 kernel solution, is there a 2.6/selinux solution
to
my problem? that would not allow anyone (even root) to do anything but
append to logs?
You also have to give up X and a few other serivces (as with BSD) but yes you
can do it