brian hatch secprogifokrorg 2n3zu4zlskbnzaj contenttype textplain charsetusascii contentdisposition inline contenttransferencoding quotedprintable simple approxmation make usr separate partion mount 20 readonly 20 good news attackers want trojan software reboot least bad news administrators want update software reboot least reboot required need remount mount remountrw usr requires root access presumably usr safe nonroot users anyway way disable kernel compiled something compartmentalizes capabilities lidsetc linux example remove cap_sys_admin lcap would definately require reboot possibly break functionatily boot pun intended apologies brian hatch expected systems dreaded security engineer wwwhackinglinuxexposedcom every message pgp signed 2n3zu4zlskbnzaj contenttype applicationpgpsignature contentdisposition inline begin pgp signature version gnupg v106 gnulinux comment info see httpwwwgnupgorg ieyearecaayfaj13o3eacgkqp6d9ahxzhxdmkacfr3mebxlfizufrdjlbwu4mh zkanrvbl3iam03pvtm6o4h9r4akqml k5ca end pgp signature 2n3zu4zlskbnzaj thu 5 sep 2002 113321 0700 use base image delta image automated recovery