Wardriving Ubuntu & /etc/resolv.conf

[Noah Dain]

On Sun, 13 Mar 2005 14:48:04 -0500, Joe Potter <jpotter1034 at cfl.rr.com> wrote:
> Hans Poppe wrote:
> > Joe Potter wrote:
> >
> 
> <snip>
> 
> 
> >
> > I ran lasattr on resolv.conf and it had an "i".
> > This is strange, I tried to edit the file in a root terminal and I could.
> > However lsattr shows that after editing the "i" is gone and the changes to
> > the file are there. I can set the "i" again, but if I can change it as root
> > any program running in sudo mode could as well??
> > Regards, Hans
> >
> >
> 
> Thanks for the test, I needed to know that. I run ext3 here with Ubuntu
> and the same with my main install of Debian.
> 
> I did find that chattr can work with reiserfs, but needs a lot of help.
> Not worth it.
> 
> If you run pump you can create a config and tell it not to overwrite. If
> you run dhcpd I think the info has already been posted here. I did
> edited the /etc/dhcp3/dhclient.conf file to get my name server running
> in Debian.
> 
> Thanks for the info, and good luck to you.
> 
> Regards, Joe
> 
> --
> ubuntu-users mailing list
> ubuntu-users at lists.ubuntu.com
> http://lists.ubuntu.com/mailman/listinfo/ubuntu-users
> 

just some observations.

well, here (running hoary) /etc/resolv.conf is a symlink.

/etc/resolv.conf points to /etc/resolvconf/run/resolv.conf, and
/etc/resolvconf/run points to /dev/shm/resolvconf/ with contains the
actual resolv.conf.

now /dev/shm is just a section of system ram, and is thus volitile.

/etc/resolvconf is a directory with configs for setting
/etc/resolv.conf, including some .d directories containing scripts
most likely used by run-parts, or something similar.

of particular interest is /etc/resolvconf/resolv.conf.d which contains
the regular files head, base, original, and tail.  head reads:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

this is, of course at the head of every /etc/resolv.conf.  So, if you
needed to force some settings into /etc/resolv.conf, I recon this
would be a place to do it (or tail, or base, depending on the nature
of the entries).

granted, I've not tested this, so...

-- 
Noah Dain
noahdain at gmail.com