I have a friend (with root access) that wants to prevent himself from having write access to /etc/hosts. I'm wondering if he can create a new user, give me the passcode for that new user, grant that new user write permissions for the file and then remove write permissions and chmod permissions for that file from root. Is something like this or something similar in effect possible?

  • If it's a case of blocking access to web/internet hosts via /etc/hosts another possibility is to use something like OpenDNS - which you can set at the router. There are relatively easy workarounds, but that's true for /etc/hosts entries too. – pbhj Jan 3 '19 at 16:49

Nope, the root user can not possibly be restricted. If you have root access, you can do everything and also revert all kinds of protections one could think of.

Besides, you should normally not directly use the root account anyway but log in as regular user and use sudo to run single commands with elevated permissions. This also helps preventing some accidental changes, compared to always operating in a root shell.

To further protect against accidental modification, you could make the file immutable using

sudo chattr +i /etc/hosts

to prevent modifications by everybody, including root and system processes (which might be something that could cause trouble depending on the file and what you're doing with it). But still, root can lift that protection again.

To sum it up, with great powers (root login or sudo access) comes great responsibility. If your friend thinks they must be prevented from altering system files like that, they should not have administrative access to the machine.

  • Perhaps I've misread the situation but it's worth noting that modifications will be recorded, that the system can be set to log sudo commands; you could have off-site journals to get around local modification of log files, but it starts getting super convoluted IMO. (Maybe point a private webcam at the computer.) – pbhj Jan 3 '19 at 16:54
  • An excellent, concise answer that covers all the bases. This is the right way to look at the problem. – user535733 Jan 3 '19 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.