I've known about the ability to drop to a root shell for quite a while. You just hold shift and select (recovery mode) from the list of kernels presented.

I would mess up an install, then drop to root shell and be confused as to how that's useful when it's read only and I can't actually fix anything. Recently I discovered this post from 2012, showing how you can run:

mount -o remount,rw /

Which will remount root in read-write mode. I was happy that now I can edit things, and fix whatever config file I shouldn't have changed in whatever ways, but now I'm root, with access to everything root can access?

Pretty cool I thought, unless I'm somebody who doesn't own my computer. I can read all of the password containing files with permissions of root:root 400. I can modify config files and cause all kinds of mayhem.

So the question is, if someone has physical access to my machine, is my system vulnerable to their knowledge of this? Is there something I'm missing?

Is full disk encryption the only way to go?


1 Answer 1


Yes, disk encryption is pretty much the only way to go to protect your data. For example, without it and with enough physical access, one attacker can just take the disk out and put it in a external usb enclosure to read it from his system.

And setting the root password is not enough, one can boot with init=/bin/bash to bypass any checks, that's a well known trick.

So I would recommend to check the bios ( so someone cannot boot on a livecd, or at least, not without fiddling with bios ). Then you can also set a password on grub to prevent people from messing with the configuration, among other things.

That should prevent the most common attacks. Then you have more sophisticated ones like Hardware keylogger, Evil maid attack where your bootloader is replaced, etc, etc, but that's IMHO complicating the answer.

Security is a complex matter, and you have to see what kind of threat you face before choosing what you want to do.

Not the answer you're looking for? Browse other questions tagged or ask your own question.