diff --git a/README.md b/README.md index a5481cf7..e4e91031 100644 --- a/README.md +++ b/README.md @@ -433,13 +433,15 @@ something were moved to overwrite it, then the hash is no longer the same and that will make it no longer trusted. 5) Does this protect against root modifications? -If you are root, you can change the rules or simply turn off the deamon. So, -this is not designed to prevent root from doing things. None of the integrity -subsystems on Linux are designed to prevent root from doing things. There -has to be a way of doing updates or disabling something for troubleshooting. -For example, you can change IMA to ima_appraise=fix in /etc/default/grub. You -can run setenforce=0 to turn off selinux. You can also set selinux=0 for the -boot prompt. The IPE integrity subsystem can be turned off via + +If you are root, you can change the fapolicyd rules or simply turn off the +deamon. So, this is not designed to prevent root from doing things. None of +the integrity subsystems on Linux are designed to prevent root from doing +things. There has to be a way of doing updates or disabling something for +troubleshooting. For example, you can change IMA to ima_appraise=fix in +/etc/default/grub. You can run setenforce=0 to turn off selinux. You can also +set selinux=0 for the boot prompt. The IPE integrity subsystem can be turned +off via ``` echo -n 0 > "/sys/kernel/security/ipe/Ex Policy/active"