I wanted to know if there is a way to prevent the assignment of UID=0 to any other account other than root.
|
feedback
|
migrated from stackoverflow.com Sep 30 '10 at 13:18
This question came from our site for professional and enthusiast programmers.
|
You can't. "root" is just a name, and it's perfectly valid to create an account "bennybunny" with UID 0. But that is only possible for a process that already runs as UID 0... To the UNIX/Linux kernel, all that matters are the numbers. In userspace, through libc, there are mappings to map the numbers to names. It's perfectly possible and valid to have several names map to the same number, BTW. | |||
|
feedback
|
|
The easiest I can think of is making /etc/passwd a read-only file. As this has the obvious side-effect of disallowing any creation or updates of accounts altogether, I would not do this. Perhaps instead of thinking about uid 0 you should rather have a look at SELinux which offers mandatory access control and not even root is allowed to do everything. | |||||||
feedback
|
