Get the latest tech news
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
This configuration creates a logical hierarchy: general system messages land in/var/log/messages, while specific services get their own dedicated log files. Even more concerning: any attacker with root access can simply open the log files directly and delete specific lines, modify timestamps, or insert false entries. Once the system reaches normal security level, even root cannot tamper with these logs without rebooting into single-user mode – exactly the kind of forensic integrity ISO 27001 demands.
Or read this on Hacker News