This question already has an answer here:
- How to secure grub recovery mode 2 answers
I've known about the ability to drop to a root shell for quite a while. You just hold shift and select (recovery mode) from the list of kernels presented.
I would mess up an install, then drop to root shell and be confused as to how that's useful when it's read only and I can't actually fix anything. Recently I discovered this post from 2012, showing how you can run:
mount -o remount,rw /
Which will remount root in read-write mode. I was happy that now I can edit things, and fix whatever config file I shouldn't have changed in whatever ways, but now I'm root, with access to everything root can access?
Pretty cool I thought, unless I'm somebody who doesn't own my computer. I can read all of the password containing files with permissions of root:root 400. I can modify config files and cause all kinds of mayhem.
So the question is, if someone has physical access to my machine, is my system vulnerable to their knowledge of this? Is there something I'm missing?
Is full disk encryption the only way to go?