2

Windows has File Protection feature, according to Microsoft:

Windows File Protection (WFP) prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system.

WFP protects critical system files that are installed as part of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and some True Type fonts). WFP uses the file signatures and catalog files that are generated by code signing to verify if protected system files are the correct Microsoft versions. Replacement of protected system files is supported only through the following mechanisms:

  1. Windows Service Pack installation using Update.exe
  2. Hotfixes installed using Hotfix.exe or Update.exe
  3. Operating system upgrades using Winnt32.exe
  4. Windows Update

If a program uses a different method to replace protected files, WFP restores the original files. The Windows Installer adheres to WFP when installing critical system files and calls WFP with a request to install or replace the protected file instead of trying to install or replace a protected file itself.

Does Ubuntu offer such a feature?

EDIT: https://en.wikipedia.org/wiki/Windows_Resource_Protection This Seems to replace WIndows File Protection, basically Only one system account owns the system files, processes running with administrator rights cannot replace system files and only TrustedInstaller processes can replace system libraries and registry entries.

  • 2
    yes, but infinitely more powerful and controllable. This reference *(amongst others) offers an explanation. guru99.com/file-permissions.html – User24601 Sep 19 at 13:16
  • @User24601 I've learned about file permissions, but i mean, is Ubuntu protecting its critical system libraries/executables/drivers from modification by potentially malicious installed software? For example only 4 or so executables have the right to modify system files in Windows. – Lyubomir Sep 19 at 14:32
  • @User24601 File permissions do not protect files from root processes. – FedonKadifeli Sep 19 at 14:40
  • You are comparing apples to oranges. Unix and Windows have completely different approaches to users/permissions and the implementation of the kernel. – Nmath Sep 19 at 17:20
  • @Frobozz Well, i got this info from support.microsoft.com/en-us/help/222193/…. So you mean, any process can just pretend to be the operating system on its own will? Then why WFP even exists it if can't guarantee its features? – Lyubomir Sep 21 at 9:37
5

The answer is no; Ubuntu does not have an equivalent to MFP/MRP.

In Unix, if you have root access, there is no limit to the destruction you can wreak upon the filesystem. Most of us understand and accept this.

In Windows, Administrator logins start with a limited set of rights assigned, via tokens, to their logon process. But they have the ability to create new tokens and processes with elevated rights and to impersonate any security principles; including localsystem and trustedinstaller. Once that is accomplished, they can destroy the filesystem just as effectively as root on Linux. There are just more hoops to jump through (the Microsoft way).

Consequently, for those of us that have deep understanding of both environments, MFP/MRP feel more like marketing than actual protection.

Don't listen to the marketing!

Windows or Linux, you simply must assume your system will get trashed (or at the very least, pick up annoying behavior) from time to time - for any number of reasons. Real protection only comes from a robust backup/recovery strategy.

"Be prepared!" - Japeth the Goat, Hoodwinked

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.