Securelevel provides convenient means of
“locking down”
a system to a degree suited to its environment.
It is normally set at boot via the
rc.securelevel(8)
script, or the superuser may raise securelevel at any time by modifying the
kern.securelevelsysctl(8)
variable.
However, only
init(8)
may lower it once the system has entered secure mode.
A kernel built with
-optionINSECURE
in the config file will default to permanently insecure mode.
Highly secure mode may seem Draconian, but is intended as a last line of
defence should the superuser account be compromised.
Its effects preclude
circumvention of file flags by direct modification of a raw disk device,
or erasure of a file system by means of
newfs(8).
Further, it can limit the potential damage of a compromised
“firewall”
by prohibiting the modification of packet filter rules.
Preventing
the system clock from being set backwards aids in post-mortem analysis
and helps ensure the integrity of logs.
Precision timekeeping is not
affected because the clock may still be slowed.
Because securelevel can be modified with the in-kernel debugger
ddb(4),
a convenient means of locking it off (if present) is provided
at securelevels 1 and 2.
This is accomplished by setting
ddb.console
and
ddb.panic
to 0 with the
sysctl(8)
utility.
FILES
/etc/rc.securelevel
commands that run before the security level changes