LinuxÏ·ÀÖ¹ÎļþÎóɾ³ýµÄÌØÊâ·½·¨

ͨ³£ÒªÓÃһЩÌØÊâµÄ·½·¨£¬·ÀÖ¹Îóɾ³ý£¬ÆäʵÎóɾ³ýÊÇ¿ÉÒÔ·ÀÖ¹µÄ£¬ÌØÒâɾ³ýÊÇÎÞ·¨·ÀÖ¹µÄ¡£
Îóɾ³ý£¬Í¨³£ÊÇchattr +i filename
[root@imdba imdba_t2]# ls -ltr
total 116
-rw-rw—- 1 mysql mysql    61 Oct 17 16:08 db.opt
-rw-rw—- 1 mysql mysql  8556 Oct 17 16:09 imdba_t2_t.frm
-rw-rw—- 1 mysql mysql 98304 Oct 17 16:09 imdba_t2_t.ibd
[root@imdba imdba_t2]# chattr +i *
[root@imdba imdba_t2]# lsattr
—-i——– ./imdba_t2_t.ibd
—-i——– ./imdba_t2_t.frm
—-i——– ./db.opt
(root:NovaTestDB:Sat Oct 17 16:09:50 2009)[imdba_t2]> drop database imdba_t2;
ERROR 6 (HY000): Error on delete of ‘./imdba_t2//db.opt’ (Errcode: 1)
¿´ÉÏÈ¥ÕâÑù¿ÉÒÔ·ÀֹһЩÈËÎóɾ³ý£¬ÕâÑùÊDz»ÊǸоõ×Ô¼ººÜ´ÏÃ÷£¬±ðÈ˺Üɵ£¬¾ÍÏÞÖÆסÁ˱ðÈËɾ³ýÁËÄØ£¿Æäʵ²»È»£¬¿´ÏÂÃæ
(root:NovaTestDB:Sat Oct 17 16:10:08 2009)[imdba_t2]>
[root@imdba imdba_t2]# chattr -i *
[root@imdba imdba_t2]# lsattr
————- ./imdba_t2_t.ibd
————- ./imdba_t2_t.frm
————- ./db.opt
(root:NovaTestDB:Sat Oct 17 16:10:44 2009)[imdba_t2]> drop database imdba_t2;
Query OK, 1 row affected (0.01 sec)
ÊDz»ÊÇÈ˼ÒÓÖ°ÑÄãµÄÊý¾Ý¿âɾ³ýÁË£¬°¥£¬Ã²ËÆÊÇÆ­È˵İÑÏ·¡£
¾­µäµÄÊÖ·¨³öÏÖÁË£¬¿´ LCAP
½éÉÜÈçÏ£º
lcap allows a system administrator to remove specific capabilities from
the kernel in order to make the system more secure. lcap modifies the
value in the sysctl file /proc/sys/kernel/cap-bound. “Capabilities” are
a form of kernel-based access control. Linux kernel versions 2.2.11 and
greater include the idea of a “capability bounding set,” a list of
capabilities that can be held by any process on the system. If a
capability is removed from the bounding set, the capability may not be
used by any process on the system (even processes owned by root).
Èç¹ûÄã²»ÖªµÀÊÇɶ£¬°¥£¬¸ã“ϵͳ°²È«”µÄ²»Äܲ»ÖªµÀÕâ¸öÍøÖ·£º
http://packetstorm