I would like to protect a system with overlayroot, so everything that is done - even by a user with root permission - will not survive a reboot. I found several guides how to do that, but none of them tells me how safe it is and if there are tricks to overcome the protection.
My approach: GRUB is locked and offers only the overlayroot-option without password.
But this is most likely not enough to protect the system, as someone (well, someone with root permission) could do dd if=/dev/zero of=/dev/sda
and I assume the system will refuse to boot after restart.
According to my research the only way to restrict root from directly accessing /dev/sda
, /dev/sda1
and so on is SELinux. SELinux seems to be horrendously complicated and complete overkill just for restricting access to a few files, but it seems the only way to restrict root.
So my questions are:
Are there any other possibilities for a user with root privilege to overcome overlayroot than accessing
/dev/sda(X)
?Are there other options to prevent access to
/dev/sda(X)
and if not is there a simple example / guide for a SELinux policy that only blocks access to certain files?
Addition 2016-09-12:
I found this: https://github.com/msuhanov/Linux-write-blocker/
It is a very small (7 lines of code) and simple kernel patch that makes the Linux kernel actually respect the read-only flag of a block device (otherwise this flag is more informative for a fs driver).
This is a great starting point, but one problem: root can easily change the read-only flag. My idea now:
The kernel is booted with additional options
forcero=/dev/sda forcero=/dev/sda1
At some point this is parsed and either a existing list of block-devices is extended with a read-only flag or a new list of read-only block-devices is created.
The code from that patch is extended to check for that flag
I know this is not perfectly safe because some custom kernel module could reset that flag (except you sign all modules and allow only signed modules).
I actually never wrote kernel code, the first problem I encountered is: I was not able to find the definition of the struct block_device
or of the function bdevname
.
I used http://lxr.free-electrons.com/ident to find it, but no luck. My second thought: If there is a list somewhere, is it stable or could a rescan for devices clear it?
There is the function name_to_dev_t
that translates a name like /dev/sda1
to the dev_t
type, which is just an integer, how is that related to block_device
?
Can somebody give me some hints how to write that kernel patch? I'm also still open for other ideas.