UNIX for Dummies Questions & Answers

Uh... no...

Code:

ln /bin/rm /bin/rm-kazamaphobia
# Now safer
rm -f /bin/rm
# At this point... things are going to be broken all over the place...
#  but at least you can get to the original rm and restore it back.

Yes exactly tested this when you posted earlier, thank you cjcox

The others who answered you before already hinted at that, but to make it as explicit as paossible:

Security is not about first allowing everything and then disallowing something specific. It is the other way round: forbid everything, carefully identify what has to be allowed and then allow exeactly that (and not more).

If you have a house it is a bad idea to first tear down every wall and then put a locked door to block a tenth of the western side. It is better to have walls all around and then put a door exactly at where visitors need to come in.

Sudo rules like the one you described are flawed in such a way they are irredeemable. It would be a good idea to identify the users real needs (not "i don't want to be slowed down by these pesky 'you are not allowed to...'-messages", but real, legitimate and arguable needs) and put that into sudo-rules.

Perhaps, if the account has only the groups it needs to have, only the rights it needs to have and only the access it needs to have, then the problem of forbidding it some "rm"-command might be already gone because the account cannot delete a file or directory it doesn't have write-access to.

And, honestly: if a user is irresponsible enough to issue rm-commands where they are harmful - do you really trust him enough to allow him the other powers that come with a sudo-rule like the above? Off the top of my head i know 10 methods to delete the file effectively without using rm at all:

Code:

cat /foo/bar > targetfile
cp /foo/bar targetfile
> targetfile
mv /foo/bar targetfile
mv targetfile /dev/null
sed '1q' targetfile > targetfile
[...]

All these commands will either reduce the file targetfile to length 0, overwrite it with meaningless information from /foo/bar (replace that with the name of any file containing nothing usable) or otherwise destroy what is in the file. You might end up with a file but all the information it held is gone. I hardly can see any improvement over the "its-gone-completely-because-of-rm"-situation.

I hope this helps.

bakunin