{"id":133709,"date":"2025-07-18T07:24:38","date_gmt":"2025-07-18T07:24:38","guid":{"rendered":"http:\/\/webdomino.net\/?guid=b70c75ec9cbb52ddf50f507101a77803"},"modified":"2025-07-18T07:24:38","modified_gmt":"2025-07-18T07:24:38","slug":"when-root-meets-immutable-openbsd-chflags-vs-log-tampering","status":"publish","type":"post","link":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/","title":{"rendered":"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering"},"content":{"rendered":"\nIn a recent blog post <em><a href=\"https:\/\/rsadowski.de\/posts\/2025\/openbsd-immutable-system-logs\/\">When Root Meets Immutable: OpenBSD chflags vs. Log Tampering<\/a><\/em>, Rafael Sadowski (<code>rsadowski@<\/code>) takes a deep dive into an infrequently mentioned feature of our favorite operating system: <em>file immutability and the <a href=\"https:\/\/man.openbsd.org\/chflags\">chflags<\/a> command<\/em>. From the article:\r\n<p>\r\n<blockquote>\r\n\" ... anyone who\u2019s ever had to investigate a security incident knows the harsh reality: logs are only as trustworthy as their protection against post-incident tampering. An attacker who gains root access isn\u2019t going to politely leave their tracks in the log files \u2013 unless they physically can\u2019t alter them anymore.\"\r\n<\/blockquote>\r\n<\/p><p>\r\nRead the whole thing, <em><a href=\"https:\/\/rsadowski.de\/posts\/2025\/openbsd-immutable-system-logs\/\">When Root Meets Immutable: OpenBSD chflags vs. Log Tampering<\/a><\/em>, over at <a href=\"https:\/\/rsadowski.de\/\">Rafael's site<\/a>! \r\n\n\n<\/p>","protected":false},"excerpt":{"rendered":"<p>In a recent blog post When Root Meets Immutable: OpenBSD chflags vs. Log Tampering, Rafael Sadowski (rsadowski@) takes a deep dive into an infrequently mentioned feature of our favorite operating system: file immutability and the chflags command. From&#8230;<\/p>\n","protected":false},"author":174,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4132],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>When Root Meets Immutable: OpenBSD chflags vs. Log Tampering - WebDomino.NET<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering - WebDomino.NET\" \/>\n<meta property=\"og:description\" content=\"In a recent blog post When Root Meets Immutable: OpenBSD chflags vs. Log Tampering, Rafael Sadowski (rsadowski@) takes a deep dive into an infrequently mentioned feature of our favorite operating system: file immutability and the chflags command. From...\" \/>\n<meta property=\"og:url\" content=\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/\" \/>\n<meta property=\"og:site_name\" content=\"WebDomino.NET\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-18T07:24:38+00:00\" \/>\n<meta name=\"author\" content=\"OpenBSD Journal\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"OpenBSD Journal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/\",\"url\":\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/\",\"name\":\"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering - WebDomino.NET\",\"isPartOf\":{\"@id\":\"http:\/\/webdomino.net\/#website\"},\"datePublished\":\"2025-07-18T07:24:38+00:00\",\"dateModified\":\"2025-07-18T07:24:38+00:00\",\"author\":{\"@id\":\"http:\/\/webdomino.net\/#\/schema\/person\/5e6479eaee9a98381747d6c8acf6be72\"},\"breadcrumb\":{\"@id\":\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/webdomino.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/webdomino.net\/#website\",\"url\":\"http:\/\/webdomino.net\/\",\"name\":\"WebDomino.NET\",\"description\":\"Global NEWS WordPress site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/webdomino.net\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"http:\/\/webdomino.net\/#\/schema\/person\/5e6479eaee9a98381747d6c8acf6be72\",\"name\":\"OpenBSD Journal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/webdomino.net\/#\/schema\/person\/image\/\",\"url\":\"http:\/\/2.gravatar.com\/avatar\/57d768f58e5bcb4c2a506e4e9cbd3a40?s=96&d=mm&r=g\",\"contentUrl\":\"http:\/\/2.gravatar.com\/avatar\/57d768f58e5bcb4c2a506e4e9cbd3a40?s=96&d=mm&r=g\",\"caption\":\"OpenBSD Journal\"},\"sameAs\":[\"http:\/\/undeadly.org\/\"],\"url\":\"http:\/\/webdomino.net\/index.php\/author\/openbsd-journal\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering - WebDomino.NET","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/","og_locale":"en_US","og_type":"article","og_title":"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering - WebDomino.NET","og_description":"In a recent blog post When Root Meets Immutable: OpenBSD chflags vs. Log Tampering, Rafael Sadowski (rsadowski@) takes a deep dive into an infrequently mentioned feature of our favorite operating system: file immutability and the chflags command. From...","og_url":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/","og_site_name":"WebDomino.NET","article_published_time":"2025-07-18T07:24:38+00:00","author":"OpenBSD Journal","twitter_misc":{"Written by":"OpenBSD Journal","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/","url":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/","name":"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering - WebDomino.NET","isPartOf":{"@id":"http:\/\/webdomino.net\/#website"},"datePublished":"2025-07-18T07:24:38+00:00","dateModified":"2025-07-18T07:24:38+00:00","author":{"@id":"http:\/\/webdomino.net\/#\/schema\/person\/5e6479eaee9a98381747d6c8acf6be72"},"breadcrumb":{"@id":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/webdomino.net\/index.php\/openbsd\/when-root-meets-immutable-openbsd-chflags-vs-log-tampering\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/webdomino.net\/"},{"@type":"ListItem","position":2,"name":"When Root Meets Immutable: OpenBSD chflags vs. Log Tampering"}]},{"@type":"WebSite","@id":"http:\/\/webdomino.net\/#website","url":"http:\/\/webdomino.net\/","name":"WebDomino.NET","description":"Global NEWS WordPress site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/webdomino.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"http:\/\/webdomino.net\/#\/schema\/person\/5e6479eaee9a98381747d6c8acf6be72","name":"OpenBSD Journal","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/webdomino.net\/#\/schema\/person\/image\/","url":"http:\/\/2.gravatar.com\/avatar\/57d768f58e5bcb4c2a506e4e9cbd3a40?s=96&d=mm&r=g","contentUrl":"http:\/\/2.gravatar.com\/avatar\/57d768f58e5bcb4c2a506e4e9cbd3a40?s=96&d=mm&r=g","caption":"OpenBSD Journal"},"sameAs":["http:\/\/undeadly.org\/"],"url":"http:\/\/webdomino.net\/index.php\/author\/openbsd-journal\/"}]}},"_links":{"self":[{"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/posts\/133709"}],"collection":[{"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/users\/174"}],"replies":[{"embeddable":true,"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/comments?post=133709"}],"version-history":[{"count":1,"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/posts\/133709\/revisions"}],"predecessor-version":[{"id":133710,"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/posts\/133709\/revisions\/133710"}],"wp:attachment":[{"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/media?parent=133709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/categories?post=133709"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/webdomino.net\/index.php\/wp-json\/wp\/v2\/tags?post=133709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}