Why root user still act a role as God?

smack-team / smack

Smack userspace

GNU Lesser General Public License v2.1

41 stars 33 forks source link

Why root user still act a role as God? #130

Closed cxdinter closed 6 years ago

cxdinter commented 7 years ago

Hi. I am just starting to learn smack. Until now, bsaed on my understanding, root user still can do every thing, even the system already practiced smack. This is different with SELinux. Is there any way to limit/drop the capabilities from root user?

cdlscpmv commented 7 years ago

Well, you have to either drop CAP_MAC_ADMIN and CAP_MAC_OVERRIDE capabilities, or write a list of labels for which these capabilities will be effective in /sys/fs/smackfs/onlycap. If the label of a root process is not in the onlycap file, the process will be restricted.