From owner-freebsd-questions Tue Sep 17 6:55:54 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2DD0537B476 for ; Tue, 17 Sep 2002 06:55:44 -0700 (PDT) Received: from be-well.ilk.org (lowellg.ne.client2.attbi.com [24.147.188.198]) by mx1.FreeBSD.org (Postfix) with ESMTP id 45A8C43E77 for ; Tue, 17 Sep 2002 06:55:43 -0700 (PDT) (envelope-from freebsd-questions-local@be-well.no-ip.com) Received: from be-well.ilk.org (lowellg.ne.client2.attbi.com [24.147.188.198]) by be-well.ilk.org (8.12.6/8.12.5) with ESMTP id g8HDtgLm010203; Tue, 17 Sep 2002 09:55:42 -0400 (EDT) (envelope-from freebsd-questions-local@be-well.no-ip.com) Received: (from lowell@localhost) by be-well.ilk.org (8.12.6/8.12.6/Submit) id g8HDtgFN010200; Tue, 17 Sep 2002 09:55:42 -0400 (EDT) X-Authentication-Warning: be-well.ilk.org: lowell set sender to freebsd-questions-local@be-well.ilk.org using -f To: Jimmy Lantz Cc: freebsd-questions@FreeBSD.ORG Subject: Re: mount read only || chflags schg & sec level 2 References: <5.1.0.14.0.20020917103713.032c3950@mail.lusidor.nu> From: Lowell Gilbert Date: 17 Sep 2002 09:55:42 -0400 In-Reply-To: <5.1.0.14.0.20020917103713.032c3950@mail.lusidor.nu> Message-ID: <44ptvcu3dt.fsf@be-well.ilk.org> Lines: 13 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.2 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Jimmy Lantz writes: > I'm looking for away to write protect > some files whats the pros and cons > with having the file on a seperate partition and mount that read-only > or use the chflags schg and go to kernel security level 2? *Either* way you probably want to raise the security level. A read-only mount doesn't help if it can be re-mounted writeable. If the files *have* to be in the same directory with writeable files (as for many systems is true of /etc), schg can be a very good solution. If the files aren't part of the standard system at all, then as someone else suggested, write-only media are an easy answer. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message