Re: Possibility to lock iptables rules.

[Jason Opperisano <opie@817west.com>]

On Wed, Apr 20, 2005 at 02:47:53PM -0400, Jason Opperisano wrote:
> i'm guessing you're thinking about how the *BSD's have a concept of
> kern.securelevel, and certain things (like firewall rules) become
> immutable; even by root, at certain levels.
> 
> i'm not a kernel programmer, but i can tell you that the linux kernel
> doesn't have anything like kern.securelevel; and without it, i don't
> believe what you're asking for is possible.  i'd also figure that
> implementing kern.securelevel in the linux kernel would be beyond the
> scope of what the netfilter developers are responsible for.

after pondering this further (post-post, natch)...i had a thought 
(yes--it hurt).  you could probably use SELinux to achieve this.  the
minimal benefits that others have pointed out, and the overly complex
nature of SELinux probably yields a pretty low benefit/cost ratio,
though.

just a thought...

-j

--
"Peter: Wow, is that really the blood of Christ?
 Preacher: Yes, it is.
 Peter: Holy crap, that guy must've been wasted 24 hours a day."
        --Family Guy