append only file system - selinux?

[Alan Cox]

On Thu, Mar 24, 2005 at 03:58:40PM -0500, Chris Stankaitis wrote:
> and corrected here) this can not be done on the kernel level in 
> RHEL/Fedora, I can chattr a log append only but any root user can take 
> the flag off, clean up the stuff in the log they don't want seen and 
> re-chattr the file.

SELinux allows you to write rules to do this

> I know on BSD variants you can set this on an OS level, thus to subvert 
> the logs you would need to reboot, change the setting, do your dirty 

Or a kernel security hole in either. 

> If there is no 2.4 kernel solution, is there a 2.6/selinux solution to 
> my problem? that would not allow anyone (even root) to do anything but 
> append to logs?

You also have to give up X and a few other serivces (as with BSD) but yes you
can do it