from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id B0AD116F1F
	for <jm@localhost>; Fri,  6 Sep 2002 11:36:17 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Fri, 06 Sep 2002 11:36:17 +0100 (IST)
from webnote.net (mail.webnote.net [193.120.211.219]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g869rWC29309 for
    <jm@jmason.org>; Fri, 6 Sep 2002 10:53:32 +0100
from outgoing.securityfocus.com (outgoing3.securityfocus.com
    [66.38.151.27]) by webnote.net (8.9.3/8.9.3) with ESMTP id XAA18906 for
    <jm@jmason.org>; Thu, 5 Sep 2002 23:07:03 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    D2526A3115; Thu,  5 Sep 2002 14:17:55 -0600 (MDT)
(qmail 32494 invoked from network); 5 Sep 2002 18:17:24 -0000
Re: use of base image / delta image for automated recovery from
    attacks
From secprog-return-490-jm=jmason.org@securityfocus.com  Fri Sep  6 11:37:35 2002

> Simple approxmation to this: make /usr a separate partion, and mount it=
>    * The good news: attackers that want to trojan your software have to
>    * The bad news: administrators that want to update your software
No reboot is required, you just need to remount it:
This requires root access, but presumably /usr is safe from non-root
Only way to disable this is to have the kernel compiled with something
that compartmentalizes capabilities (LIDS/etc on Linux for example) or to
remove CAP_SYS_ADMIN with lcap, which would definately require a reboot,
and possibly break some other functionatily to boot.  (Pun intended.  My
Brian Hatch                  "Are you expected?"

from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id CEF2016F20
	for <jm@localhost>; Fri,  6 Sep 2002 11:36:19 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Fri, 06 Sep 2002 11:36:19 +0100 (IST)
from webnote.net (mail.webnote.net [193.120.211.219]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g869vcC29825 for
    <jm@jmason.org>; Fri, 6 Sep 2002 10:57:38 +0100
from outgoing.securityfocus.com (outgoing2.securityfocus.com
    [66.38.151.26]) by webnote.net (8.9.3/8.9.3) with ESMTP id VAA18304 for
    <jm@jmason.org>; Thu, 5 Sep 2002 21:36:52 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    E1EB28F2C6; Thu,  5 Sep 2002 13:38:50 -0600 (MDT)
(qmail 12968 invoked from network); 5 Sep 2002 17:15:58 -0000
Crispin Cowan <crispin@wirex.com>,
	"Webappsec Securityfocus.Com" <webappsec@securityfocus.com>,
	SECPROG Securityfocus <SECPROG@securityfocus.com>
From secprog-return-493-jm=jmason.org@securityfocus.com  Fri Sep  6 11:37:38 2002