> > It used to be possable to prevent undelete by deleting a file, over
> > writing it byte for byte, and deleting that file. But it seems that this
> > no longer works under the newer kernels. How could one be prevented for
> > undeleting files under the newer kernels? And info would be greatly
> > appreaciated. Thanks.
> I'd be amazed if that ever worked.
> You have to over-write the file, and sync, _before_ you unlink it.
> You can hold a file open THEN unlink it though - this will prevent
> anyone else from opening the file while it is being over-written.
> As long as a file is held open, its data is kept intact after an unlink.
I'm not sure of the status of it, but didn't the attribute 's' (see
chattr(1)) accomplish this?
ie,
chattr +s filename
--- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- Stephan K. Zitz My mind is my best friend... mailto:zitz@io.com And my worst enemy http://www.io.com/~zitz http://www.erf.net/~zitz -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- -=*=- "Intelligence is the ultimate aphrodisiac" -- Timothy Leary