Re: immutable etc.

[Christoph Hellwig <hch@xxxxxxxxxx>]

On Thu, Dec 07, 2000 at 05:25:57PM +1100, Timothy Shimmin wrote:
> Immutable sounds pretty much what one could achieve using the
> standard access modes except for ROOT being disallowed to change
> the file (without first setting the attribute).
> OOI, how useful is this attribute ?

The basic idea of immutable files is that you drop
CAP_LINUX_IMMUTABLE for all processes, and attackers won't be able
to modifiy your binaries even if they have root access.

        Christoph

-- 
Of course it doesn't work. We've performed a software upgrade.