>>>>> "BE" == Bruce Evans <[EMAIL PROTECTED]> writes:

BE> revision 1.9
BE> date: 1997/06/25 07:31:47;  author: joerg;  state: Exp;  lines: +2 -2
BE> Don't ever allow lowering the securelevel at all.  Allowing it does
BE> nothing good except of opening a can of (potential or real) security
BE> holes.  People maintaining a machine with higher security requirements
BE> need to be on the console anyway, so there's no point in not forcing
BE> them to reboot before starting maintenance.

That last sentence makes me think that the person who decided this
does not use a network to update that machine, ie NFS mounting
/usr/src.  It is a royal PITA to get networking up and going after a
single-user reboot to get out of secure level.

Perhaps one of the secure level restrictions should be that you cannot
attach to pid 1 via the debugger.

Does the kernel have an idea of single user mode or is that purely a
user space thing?  Perhaps the kernel could drop the restrictions when
in single user mode itself.

Vivek Khera, Ph.D.                Khera Communications, Inc.
Internet: [EMAIL PROTECTED]       Rockville, MD       +1-301-545-6996
GPG & MIME spoken here            http://www.khera.org/~vivek/

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message

Reply via email to