Skip to content

Commit

Permalink
update text a little
Browse files Browse the repository at this point in the history
  • Loading branch information
RH-steve-grubb committed Mar 31, 2021
1 parent 71df36d commit ea3f3d7
Showing 1 changed file with 9 additions and 7 deletions.
16 changes: 9 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -433,13 +433,15 @@ something were moved to overwrite it, then the hash is no longer the same and
that will make it no longer trusted.

5) Does this protect against root modifications?
If you are root, you can change the rules or simply turn off the deamon. So,
this is not designed to prevent root from doing things. None of the integrity
subsystems on Linux are designed to prevent root from doing things. There
has to be a way of doing updates or disabling something for troubleshooting.
For example, you can change IMA to ima_appraise=fix in /etc/default/grub. You
can run setenforce=0 to turn off selinux. You can also set selinux=0 for the
boot prompt. The IPE integrity subsystem can be turned off via

If you are root, you can change the fapolicyd rules or simply turn off the
deamon. So, this is not designed to prevent root from doing things. None of
the integrity subsystems on Linux are designed to prevent root from doing
things. There has to be a way of doing updates or disabling something for
troubleshooting. For example, you can change IMA to ima_appraise=fix in
/etc/default/grub. You can run setenforce=0 to turn off selinux. You can also
set selinux=0 for the boot prompt. The IPE integrity subsystem can be turned
off via

```
echo -n 0 > "/sys/kernel/security/ipe/Ex Policy/active"
Expand Down

0 comments on commit ea3f3d7

Please sign in to comment.