It is a very powerful method to set files as not modifiable even by the root user. Usually configuration files, binaries, and libraries, which are static in nature, are good candidates to set as immutable.
Before you change the file attribute to immutable, be absolutely sure that these files are static and may not cause outages.
For example, to prevent any modification to the Oracle listener configuration file
listener.ora, modify it as immutable by executing the following command:[root@nodeorcl1 kit]# chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as ----i--------
Now the file cannot be modified even by the root user:
[root@nodeorcl1 kit]# echo "" >> /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora bash: /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora: Permission denied
At this step, we will set a library as immutable. For example, to protect against disabling the Oracle Database Vault option, turn
$ORACLE_HOME/rdbms/lib/libknlopt.aimmutable:chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a chattr 1.39 (29-May-2006) Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as ----i--------
If we try to disable the Oracle Database Vault option, we will receive an
Operation not permittedmessage:[oracle@nodeorcl1 lib]$ make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk dv_off /usr/bin/ar d /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a kzvidv.o /usr/bin/ar: unable to rename '/u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a' reason: Operation not permitted make: *** [dv_off] Error 1 [oracle@nodeorcl1 lib]$
To check if a file is immutable we can use the
lattrcommand:[root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora ----i-------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora [root@nodeorcl1 kit]#
To disable the immutable flag from
listener.ora, execute the following command:[root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora chattr 1.39 (29-May-2006) Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as -------------
The
lsattrcommand can be used to check if the immutable flag is on or off:[root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora ------------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora [root@nodeorcl1 kit]#
The immutable flag can be set with the chattr command using the +i switch. To disable the immutable flag use –i. The –V switch translates to verbose mode. More about the chattr command can be found in the man pages.
In this section we will see how we can use lcap to prevent the root user from changing the immutable attribute. The kernel capabilities modified with lcap will stay disabled until the system is rebooted.
The lcap utility can disable some specific kernel capabilities.
Download and install
lcap:[root@nodeorcl1 kit]# rpm -Uhv lcap-0.0.6-6.2.el5.rf.x86_64.rpm warning: lcap-0.0.6-6.2.el5.rf.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6 Preparing... ########################################### [100%] 1:lcap ########################################### [100%] [root@nodeorcl1 kit]#
Disable the possibility to disable or enable immutability for files:
[root@nodeorcl1 kit]# lcap CAP_LINUX_IMMUTABLE [root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a chattr 1.39 (29-May-2006) Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as ------------- chattr: Operation not permitted while setting flags on /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a