Preventing root from overwriting a file

Is there any way to keep pacman (or other package managers that run as root) from overwriting a file in a directory where it would normally be overwritten? Without using the immutable flag (which only works on ext* filesystems)? I know this should strictly never be necessary, but if there is any way to render things read-only for root, I think it would be useful to know.

Pacman creates .pacnew files for the files in backup array:
[karol@black ~]$ sp -Qii initscripts
Name : initscripts
Version : 2011.07.3-1
URL : http://www.archlinux.org
Licenses : GPL2
Groups : base
Provides : None
Depends On : glibc bash grep coreutils udev>=171 iproute2 ncurses kbd findutils
sysvinit
Optional Deps : bridge-utils: Network bridging support
dhcpcd: DHCP network configuration
net-tools: legacy network support
wireless_tools: Wireless networking
Required By : None
Conflicts With : None
Replaces : None
Installed Size : 112,00 K
Packager : Tom Gundersen <[email protected]>
Architecture : i686
Build Date : czw, 28 lip 2011, 14:42:30
Install Date : nie, 31 lip 2011, 09:14:39
Install Reason : Explicitly installed
Install Script : Yes
Description : System initialization/bootup scripts
Backup Files:
MODIFIED /etc/inittab
MODIFIED /etc/rc.conf
MODIFIED /etc/rc.local
UNMODIFIED /etc/rc.local.shutdown
UNMODIFIED /etc/conf.d/wireless

Similar Messages

Preventing XI from consuming a file before it is time

Hi all,
I wish I could prevent XI from consuming a file in the outbound directory before it is time.
There are two business aspects :
1- a new file with the same name could be sent in the outbound directory and the old file should be erased by the new one
2- the message(s) extracted from the file should be sent to the receiver only during a certain period when the receiving application is ready for it.
As this problem is common to many scenarii, I am looking for some reusable solution.
I thought of (or was proposed) the following solutions :
- event-driven messages : the condition 2 is OK, but the file is consumed, so if a new file arrives, it is also consumed and both sets of data are sent to the receiver. Therefore, condition 1 is not correct.
- BPM : I am not yet familiar with this part of XI, and I wonder whether it could work.
- module adapter : as a Java developer, it was nearly piece of cake to say whether it was time or not to send the message(s) . But the module is executed after the file was processed, so condition 1 isn't fulfilled because the incoming file has been moved to archive directory before the authorized period. I tried to change the Processing mode from "archive" to "test" in order to avoid the file being moved and it works fine, except I'm not keen doing that in a production environment.
Moreover, when it is not time, how to cleanly" stop the process? I figured out I could sweep all data from xmlpayload so the process would carry one, but with no data. I don't know why, but it produces some mapping error and a red flag in monitoring. I also thought about throwing Exceptions, but I have no monitoring.
It's quite a long blog, but I wanted to explain what the problem was and what ways I tried.
Has anybody some advice to give me (except suicide, my boss wants his problem solved first ) ?
Regards
Yann

Hi,
>>>Isn't there any solution only using XI and Java (for functions, modules...)?
yes but a littble bit more difficult:
instead of the ABAP report you can send ANY
scheduled message to the XI (using any adapter)
and this will invoke the java proxy
that will move the file to the correct folder
so it can picked by the file adapter
at that correct time
BTW
it's that with ABAP you have nice SAP scheduler
that you can use
Regards,
michal

So what can I do to prevent webstart from caching my files?

Hi
I have installed java jre-7u7-windows-i586.exe on windows 7.
and this pseudo code running within webstart:
HttpURLConnection conn = (HttpURLConnection) resource.openConnection();
File cached.......
conn.setIfModifiedSince(cached.lastModified());
conn.connect();
int code = ((HttpURLConnection) conn).getResponseCode();
Now my problem is that I always get 200 for the int code back.
But it should be 304 (not modified)
This happens because webstart is serving the file from ist cache as I can see in the following trace log entry
network: Cache entry found [URL: https://server.com/wanted.jar, Version: null] prevalidated=false/0
but this is not good for me....
In the jsp serving the file I have a
((HttpServletResponse) response).setHeader("Cache-Control", "no-cache");
So what can I do to prevent webstart from caching my files?
Edited by: 962394 on 11.10.2012 10:11
Edited by: 962394 on 11.10.2012 10:12

i just found the solution
Java 7 JWS URLConnection caching
I need todo
conn.setUseCaches(false);

Oracle on Linux - prevent root from viewing database information

Thanks to the cloud, we have a new wrinkle in our security. We use a cloud-hosting service to host our infrastructure, and this provider also performs management of our hosts (package updates, network configuration, etc). Oracle runs on RHEL6, and our cloud-hosting provider necessarily has root access to the server to perform management of the host. As root they can su to the oracle user and from there get in using "sqlplus / as sysdba". Is there any way to prevent them from gaining access to the database?

Hi,
is it possible ?
Oracle Database Vault Security Guidelines :
Logging in as any user, including the user who owns the Oracle Database installation
Oracle Database Vault does not provide protection against the operating system root access. Ensure that you grant root user privileges only to the appropriate people with the appropriate responsibility.
Regards.

Stop updates from overwriting .service files?

I've looked for some time and can't seem to find the answer. Every time lirc is updated with pacman it overwrites my custom lirc.service file, the only search result i've found mentions using NoUpgrade with pacman but that was from 2010 and doesn't seem to be in the pacman man file any longer?

Thank you! That's what I needed to get it to accept my conf tweak for cronie - it wouldn't accept a second ExecStart line and it wasn't clear how to override it. I remembered something vaguely but I couldn't find anything easily when I searched. (Is there documentation on this?)
Also, how would you use this to adapt a particular instance of a template? I actually tried this and I have now managed to mess up the getty on tty even though I thought I'd backed out all my changes. So I'm a bit wary.
I tried creating
# [email protected]/TTYVTDisallocate-BLOCK.conf
[Service]
TTYVTDisallocate=no
but it did not work quite as expected. Trying to change it back, I removed this directory etc. but tty1 is still allocated, I think (I can still log in there) and I have no idea why.
I'm actually really not clear how the getty service affects only tty1 anyway except that it seems that tty2-6 are created with generators rather than with this service so it effectively only applies to tty1.
Last edited by cfr (2013-08-19 02:07:42)

How can I prevent Firefox from opening the file I create when I print a page with PDF Create! 5

After I print a web page using PDF Create! 5, Firefox opens the file so i can view it. Before I print, I select print properties and disable "view resulting pdf". However, the file is always opened in Adobe Acrobat, although I believe I have Adobe Reader set as default. I do not want any file to open. This happens on my non-privileged accounts. On my privileged account, the file is not opened. I have removed Firefox profiles, re-installed Firefox, Reset Firefox in Help-Troubleshooting. PDF Create!5 print screen can only be viewed in a host program such as Firefox, Libre-office Writer, or any other program that prints. They do not open the file either.

Thanks for your help. This is the Scansoft (Nuance) program. What I do not understand is why when I tell the print driver not to open the file with a privileged account, it obeys me. I am not sure where in the registry I would look for the information. I do not want to, but perhaps I should remove the Adobe Acrobat program (temporarily?) - then what would it do? Again, when I print from other programs - browsers, wordprocessors, etc - the file is not opened after printing, just with FireFox. I guess I can live with it, I have spent too much time already.

How do I prevent AE from saving .AEP files in the wrong folders?

I've been using AE heavily for about 6 months, and it has this really pesky basic Windows UI problem that makes life quite frustrating. I work on lots of projects that I maintain sequentially numbered in their respective folders. Typically in Windows when you choose "Save As" windows defaults to the folder the current file resides in. For some reason After Effects defaults to the last folder I saved a file in, which often times is not the folder I am in. So I end up with project files from projectA stored in the projectB folder. This leads to version control problems when members of the team can't find the most recent version of projectA and so they start working on the previous version of ProjectA and later on ask me where all my changes are. I want to believe that AE has a checkbox in preferences somewhere that says "make save-as feature operate like every other windows program" - but I haven't found it yet. Does anyone have any advice on this topic?

I want to believe that AE has a checkbox in preferences somewhere that says "make save-as feature operate like every other windows program" - but I haven't found it yet. Does anyone have any advice on this topic?
I think you are operating on wrong assumptions - a project is just a reference to other files plus some internal data, so it doesn't exactly make sense to maintain endless lists of absolute paths, given that you can import things back and forth in a million ways. What happens as soon as you import a project into another one? What, when you collect files? What happens when you re-import pre-rendered files? A "same origin" policy would be riddled with tons of issues to figure out the logic as to what the user actually wants to do and which path is the correct one.... I've never missed any such feature.
Mylenium

How do I prevent Spotlight from categorizing 'JAR' files as 'Application'

I'm a java developer and consequently I have a lot of JAR files on the filesystem. The JAR file format is a standard archive format for java, and is used mostly to package library code - the java equivalent of a DLL. They can also be created as 'executable JAR's, but this is (very) infrequent compared to the library usage.
Spotlight seems to think every JAR file is an application, and because I have a lot of java applications and development stuff installed, I can no longer reliably use Spotlight to find actual applications because the search results are overflowing with useless JAR file entries.
Is there any way to configure spotlight to not classify JARS as applications? Or, alternately, can I make Spotlight ignore JARs completely? Either would save me a lot of time..
/Bill

There are several things in the current version of Spotlight that are either broken or just plain wrong. It looks like you have found another. When I look at the metadata for a jar file I see that its type is, well, a java jar file, and its content tree declares it to be a com.sun.java-archive. Finder gets this right: if you do GetInfo on such a jar file its kind is shown as "Java JAR file"--as it should be.
When I made a saved search, using the Kind drop-down menu to get the pre-defined Application, and then looked to see what criteria Spotlight was using to define "application" (and yes, the search included jar files in its results), I discovered Spotlight was NOT using the simple, straightforward "kMDItemKind=Application" as one would expect. Instead it is using something I had never heard of to define an Application, to wit "_kMDItemGroupId = 8"--furthermore, I believe characterizing applications that way has been deprecated. Be that as it may, it doesn't work to find the things you want, and exclude the things you don't.
There is no way for a user to fix this. The only thing you can do is not let Spotlight define the kind. Thus, if you bring up a search window do not use the Kind drop-down menu to select Application. Instead select Other from the menu and then type Application. You then get only things whose type declaration is Application, and you don't get jar files or widgets.
The other option is to exclude jar files by typing
NOT jar
in the search for box (you'll still get widgets though). You can also add that boolean restriction if you are using the menu bar Spotlight search.
Francine
Francine
Schwieder

[Solved] Way to prevent acroread from opening pdf files in firefox?

Hi,
I recently installed acroread from aur and now everytime when I click on a link to a pdf-file in firefox, the acroread plugin opens the file in the browser.
Before I installed acroread I got a dialog, where I could choose what to do with the pdf-file.
Under Preferences->Applications I selected "Always ask" for the application type "pdf" but obviously this option is not considered.
Thanks for any ideas.
Last edited by otti (2008-11-04 18:57:56)

Try disabling Adobe Reader plugin in Firefox. Edit>Pref>Manage Add-ons>Plugins.
Last edited by jo3 (2008-11-04 17:07:35)

Prevent children from deleting important files?

My family is going to be purchasing a new iMac soon, to be used by four children, including a 12-year old. The problem is that he is known for "screwing up" computers.
The computer we have now suffers from a lack of printer drivers and system profiler, both which were "accidentally" deleted by him.
My question is, is there a way to set up parental controls that allow him to access all of the regular programs on the computer, but not be allowed to delete any files without an administrator's password? I really do not feel like digging out the startup disks every time he makes a boo-boo on the computer.

Believe me, this kid has been taught by a former Apple salesperson. He normally knows what he's doing on there, but sometimes goes a little too far when doing "Spring cleaning" when told to get rid of his junk files.
The other children are just fine on the computer, and fortunately not as curious or destructive. We've owned Macs for 13 years and never would I have thought that we'd need to do any troubleshooting like this at all! One account has always been plenty for our family of six, I guess until now. We'll see how things go after individual accounts have been created, then maybe once the trust is gained back, go back to the single user account.
Thanks to everyone for the help!

How do I stop PSE8 from overwriting raw files?

I evidently did something wrong. I wanted to edit my camera raw file but save the finished product as a JPEG. When I was finished, I noticed the raw file is now changed the same as the JPEG.
I made edits in Adobe Camera Raw Editor and clicked on Open Image to import the changes to the PSE8 Editor. Is this proper? I am learning PSE8 and am a little mixed up on use of the Camera Raw Editor and transferring the file to PSE8's Editor.
I don't really want to ever make any changes to the Raw files. I wanted to keep them original. Must I make those files "Read Only" in Windows to protect the files?
I have tried searching for info about this, with little success. I evidently can't find the right terminology for the search.
Any advice would be appreciated! Thanks in advance!
Gary.

I evidently did something wrong. I wanted to edit my camera raw file but save the finished product as a JPEG. When I was finished, I noticed the raw file is now changed the same as the JPEG.
What you describe isn't possible. PSE never changes a raw photo; in fact, it can't change a raw photo — the software simply doesn't have the capability.
Perhaps, if you are looking at the Organizer, you are looking at the JPG in a "Version Set", where in this instance the Organizer only shows the JPG and not the RAW. You should be able to uncover the RAW (which is "hidden below" the JPG in the Version Set) by right-clicking on the JPG in the Organizer and selecting Version Set->Expand...
I made edits in Adobe Camera Raw Editor and clicked on Open Image to import the changes to the PSE8 Editor. Is this proper? I am learning PSE8 and am a little mixed up on use of the Camera Raw Editor and transferring the file to PSE8's Editor.
Sounds good to me. I should point out that normally, you would do as many edits as possible in Adobe Camera Raw; and then only use the PSE Editor if you need to make edits that can't be done in ACR (for example, layers). You would NOT create a JPG or TIF or PSD if ACR did all the editing you need; in that case click on Done.
I don't really want to ever make any changes to the Raw files. I wanted to keep them original. Must I make those files "Read Only" in Windows to protect the files?
Trust me, your original RAW files are not changed at all.

Why does IE 11 prevent me from downloading PDF files. Security Settings are set at MIN. Pop Ups & Cookies are ALLOWED

I get the following pop-up displayed on my screen:
YOUR CURRENT SECURITY SETTINGS DO NOT ALLOW THIS FILE TO BE DOWNLOADED.

See if anything in here helps: http://windows.microsoft.com/en-us/windows/change-internet-explorer-security-settings#1TC= windows-7

How do I prevent icloud from overwriting my contacts when doing a restore backup from PC to iphone?

My icloud contact list is screwed up. I have my contact list in my PC backup. I've removed icloud from iphone AND changed apple ID and icloud ID, yet when I attempt to restore backup from PC to iphone, my correct contact list shows up momentarily, then reverts to the screwed up icloud contact list.
I understand that my PC backup is set to connect to icloud; however, one would think by removing the email address associated with apple or icloud that it would not be able to connect to icloud when I do a restore backup from PC to iphone. Yet each time I find icloud connected via my old email address after attempting the restore.
How do I fix this? This seems like an icloud bug, since it connects via my old email/ID.

The problem may be that the iphone is immediately syncing with icloud and losing the newly restored data. You might turn off your router. Once restored, turn off icloud on the device, turn on the router, then turn on the iphone.
(I'm going by memory on this, and that hasn't been too reliable lately.)

How do I prevent CS4 from creating HTML files on export of an image?

Everytime I export an image i am getting a html file created too. It is annoying having to delete them manually every time, and there seems to be no option to turn this feature off.
Generally I dislike CS4 compared to Macromedia Fireworks v8.

You need to select "images only" in the dialogue box when you choose Export
Nadia
Adobe® Community Expert : Dreamweaver
Unique CSS Templates |Tutorials |SEO Articles
http://www.DreamweaverResources.com
Book: Ultimate CSS Reference
http://www.sitepoint.com/launch/005dfd4/3/133
http://twitter.com/nadiap

[SOLVED] How Can I Stop DHCPCD from Overwriting my /etc/resolv.conf...

Hey guys,
For some unknown reason /etc/dhcpcd.conf continually overwrites my /etc/resolv.conf file, eventhough I set the "nohook resolv.conf" hook in /etc/dhcpcd.conf.
This is screwing up my DNS and intermittently creating connection problems. Any of you guys know why the hook is not taking effect or how I can stop dhcpcd from overwritting this file?
Thanks
Last edited by w201 (2013-03-18 19:05:15)

drcouzelis wrote:
w201 wrote:I set the "nohook resolv.conf" hook in /etc/dhcpcd.conf.
kaszak696 wrote:
dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting /etc/resolv.conf. To do this, add the following to the last section of /etc/dhcpcd.conf:
nohook resolv.conf
I don't think that information will help w201...
I changed my DNS to the Google one (8.8.8.8 or something). That's in "resolv.conf", isn't it? I remember editing some OTHER configuration file, which is then read to create the "resolve.conf" file. There it is, in that link to the wiki, under "Use resolv.conf.head". Does that help you do what you want to do?
There's three techniques at the wiki link, the nohook one, the resolv.conf.head one and the write-protection attribute.

Preventing root from overwriting a file

Similar Messages

Maybe you are looking for