>>>>> "BE" == Bruce Evans <[EMAIL PROTECTED]> writes:
BE> revision 1.9
BE> date: 1997/06/25 07:31:47; author: joerg; state: Exp; lines: +2 -2
BE> Don't ever allow lowering the securelevel at all. Allowing it does
BE> nothing good except of opening a can of (potential or real) security
BE> holes. People maintaining a machine with higher security requirements
BE> need to be on the console anyway, so there's no point in not forcing
BE> them to reboot before starting maintenance.
That last sentence makes me think that the person who decided this
does not use a network to update that machine, ie NFS mounting
/usr/src. It is a royal PITA to get networking up and going after a
single-user reboot to get out of secure level.
Perhaps one of the secure level restrictions should be that you cannot
attach to pid 1 via the debugger.
Does the kernel have an idea of single user mode or is that purely a
user space thing? Perhaps the kernel could drop the restrictions when
in single user mode itself.
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Vivek Khera, Ph.D. Khera Communications, Inc.
Internet: [EMAIL PROTECTED] Rockville, MD +1-301-545-6996
GPG & MIME spoken here http://www.khera.org/~vivek/
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message
