Using immutable files to prevent modifications

It is a very powerful method to set files as not modifiable even by the root user. Usually configuration files, binaries, and libraries, which are static in nature, are good candidates to set as immutable.

Getting ready

All steps will be performed on nodeorcl1 as root.

How to do it...

Before you change the file attribute to immutable, be absolutely sure that these files are static and may not cause outages.

1. For example, to prevent any modification to the Oracle listener configuration file listener.ora, modify it as immutable by executing the following command:

   [root@nodeorcl1 kit]# chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
   Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as ----i--------
   

2. Now the file cannot be modified even by the root user:

   [root@nodeorcl1 kit]# echo "" >> /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora 
   bash: /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora: Permission denied
   

3. At this step, we will set a library as immutable. For example, to protect against disabling the Oracle Database Vault option, turn $ORACLE_HOME/rdbms/lib/libknlopt.a immutable:

   chattr -V +i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a
   chattr 1.39 (29-May-2006)
   Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as ----i--------
   

4. If we try to disable the Oracle Database Vault option, we will receive an Operation not permitted message:

   [oracle@nodeorcl1 lib]$ make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk dv_off
   /usr/bin/ar d /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a kzvidv.o
   /usr/bin/ar: unable to rename '/u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a' reason: Operation not permitted
   make: *** [dv_off] Error 1
   [oracle@nodeorcl1 lib]$
   

5. To check if a file is immutable we can use the lattr command:

   [root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
   ----i-------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
   [root@nodeorcl1 kit]#
   

6. To disable the immutable flag from listener.ora, execute the following command:

   [root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
   chattr 1.39 (29-May-2006)
   Flags of /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora set as -------------
   

7. The lsattr command can be used to check if the immutable flag is on or off:

   [root@nodeorcl1 kit]# lsattr /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
   ------------- /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
   [root@nodeorcl1 kit]#
   

How it works...

The immutable flag can be set with the chattr command using the +i switch. To disable the immutable flag use –i. The –V switch translates to verbose mode. More about the chattr command can be found in the man pages.

There's more...

In this section we will see how we can use lcap to prevent the root user from changing the immutable attribute. The kernel capabilities modified with lcap will stay disabled until the system is rebooted.

The lcap utility can disable some specific kernel capabilities.

1. Download and install lcap:

   [root@nodeorcl1 kit]# rpm -Uhv lcap-0.0.6-6.2.el5.rf.x86_64.rpm 
   warning: lcap-0.0.6-6.2.el5.rf.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID 6b8d79e6
   Preparing...                ########################################### [100%]
      1:lcap                   ########################################### [100%]
   [root@nodeorcl1 kit]# 
   

2. Disable the possibility to disable or enable immutability for files:

   [root@nodeorcl1 kit]# lcap CAP_LINUX_IMMUTABLE
   [root@nodeorcl1 kit]# chattr -V -i /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a
   chattr 1.39 (29-May-2006)
   Flags of /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a set as -------------
   chattr: Operation not permitted while setting flags on /u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/libknlopt.a