chattr

[Bruce Dawson]

The *only* time I've seen the immutable bit set was in a system that had
been hacked (not mine), and it was on a file named "..." (3 dots). (That file
was the daemon that kept open a "telnet" port to a root shell.)

In general, this will wreck havoc with any restore procedure that uses files
instead of filesystems (tar, cpio, ... work with files; dump/restore works with
filesystems).

Personally, I would recommend *not* using the immutable bit in anything that
doesn't have its own backup/restore mechanism. In otherwords, the immutable bit
could be useful in ROM or embedded filesystems.

> Date: Thu, 13 Feb 2003 14:39:04 -0500 (GMT+5)
> Subject: Re: chattr
> From: "Mighty Industries" 
> <very_big_snip [from pll's msg]>
> > I'm really curious how often people play with the immutable bit, and
> >  for what purposes.  I've always known about it, but never had a
> > reason to muck with it.  Why do people use this?  In what scenarios?
> I did not see any responses to your query.  I, too, am interested in
> knowing more about the immutable bit.  (I once read someone suggesting
> its use in system hardening for some files in /etc/.)






-------------------------------------------------
This mail sent through IMP: www.milessmithfarm.net