Re: OpenBSD

Curse of the disappearing documentation, SWAT team hits and police raids on=
 the homes of mailing list posters. The drugs have got to go and the securi=
ty's got to come back or we're all doomed.

But right because it is still possible to rename "/etc" and change the path=
 to the "schg" immutable file -- but the rules for "schg" and "uchg" are di=
fferent from what I recall, when "uchg" required root to set or clear, but =
was resettable without rebooting, and "schg" could be set by root, but requ=
ired a reboot to single user mode to clear.

On May 24, 2022 5:13:47 PM AKDT, Theo de Raadt <[email protected]> wrote:
>That is either a funny joke, or it shows you don't understand Unix.
>
>It doesn't work because, root is all-powerful and will simply replace
>the whole /etc directory with tar cf - | tar xf -, and look at that
>the file you locked is in an irrelevant directory
>
>justina colmena ~biz <[email protected]> wrote:
>
>> Glad this was mentioned. You can go like this I think
>>=20
>> [OpenBSD] # chflags schg /etc/resolv.conf
>>=20
>> and that is irreversible until the system is rebooted to single user mod=
e. In Linux (ext2-3-4) one would use a similar command, but the system-leve=
l version is apparently not available.
>>=20
>> [Linux] # chattr +i /etc/resolv.conf
>> [OpenBSD] # chflags uchg /etc/resolv.conf
>>=20
>> But this is really an upstream "dhclient" issue of this particular file =
being overwritten in a context of persistent hacking with a German-style la=
w-enforcement or law-enforcement-like access which can be enabled on a warr=
ant and of course re-enabled whenever it is shut off by the user or consume=
r of the said Operating System.
>>=20
>>=20
>> On May 23, 2022 9:36:53 PM AKDT, Richard Bostrom <bostrom.richardh@iclou=
d.com> wrote:
>> >Dear sirs and ladies!May I please ask. Is there any way to force OpenDN=
S settings on a BSD installation, in such a way that the "su" cannot change=
 the dns settings (.conf file)?Thank you.Best regards
>> >Richardh Bostrom
>> --=20
>> Sent from my Android device with K-9 Mail. Please excuse my brevity.
>

--=20
Sent from my Android device with K-9 Mail. Please excuse my brevity.=