On 24/10/2023 13:08, Paweł Biernacki wrote:
Setting kern.securelevel to 1 makes the kernel to enforce the system-level immutable and append-only flags (see chflags(1/2)). Unless you do something extra, syslogd will create new files without these flags and newsyslog will rotate them as expected.
In other words - securelevel 1 causes that you cannot remove flags on files where append-only or immutable flags are set, securelevel cannot be lowered on running system. But on default instalation there are only few files protected by flags.
This list is from 13.2 amd64: root@neon ~/ # find -s -x / -flags +schg,sappnd /.sujournal /lib/libc.so.7 /lib/libcrypt.so.5 /lib/libthr.so.3 /libexec/ld-elf.so.1 /libexec/ld-elf32.so.1 /sbin/init /usr/bin/chpass /usr/bin/crontab /usr/bin/login /usr/bin/opieinfo /usr/bin/opiepasswd /usr/bin/passwd /usr/bin/su /usr/lib/librt.so.1 /usr/lib32/libc.so.7 /usr/lib32/libcrypt.so.5 /usr/lib32/librt.so.1 /usr/lib32/libthr.so.3 /var/empty Log files are not protected. Kind regards Miroslav Lachman
On 24 Oct 2023, at 12:19, void <v...@f-m.fm> wrote: Hi, I'd like to set append-only on an arm64 system running stable/14-n265566 (so securelevel=1) but how would newsyslog(8) handle it? How will it rotate logs? --
