9

I am under the impression that there is no real way to protect the hosts file completely without creating a none-admin user account on my Mac and setting the password of the admin account to one that I won't remember.

So therefore I would like to make editing of my hosts file difficult as a next-best alternative.

I have read that it is possible to set a system immutable flag on specific files which would need to be disabled before the files are able to be edited.

So of course it would still be possible to edit the hosts file, but it would at least make it a bit trickier.

Is this a recommended approach? or is there a better way to achieve it?

Improve this question
1
  • If you want to prevent yourself from wasting time on Facebook et all while working there are applications for this :-)
    – nohillside ♦
    Commented Apr 30, 2017 at 12:00

1 Answer 1

Reset to default
13

Protecting with ‘schg’, the system immutable flag, is a potential solution, depending on how much protection you need. You can set the schg flag using

sudo chflags schg /etc/hosts

Removal of the protection depends on your kernel security level. Run sysctl kern.securelevel:

  • 1 means you need to boot to single-user mode to run chflags noschg /etc/hosts,
  • 0 means you can simply sudo chflags noschg /etc/hosts.

Instead of schg, you can use System Integrity Protection's restricted flag in El Capitan and later. You can boot to the Recovery HD to set the flag using chflags restricted /etc/hosts.

This protects the file from modification whilst SIP is enabled, which is enabled by default and can only be disabled by booting to the Recovery HD and running csrutil disable.

Check the status of SIP by running csrutil status: if it is enabled, any files with the restricted flag cannot be modified without disabling SIP from Recovery first or by installers signed with Apple's Software Update certificate (even root cannot modify the file).

Improve this answer
11
  • thanks! I am running Yosemite so looks like schg is the only option then... my kernel security also appears to be set to 0, is there a way to increase this?
    – user206728
    Commented Apr 30, 2017 at 11:49
  • also I've tried running sudo chflags schg /etc/hosts in Terminal but I am still able to access the hosts file with sudo nano /etc/hosts... is this normal?
    – user206728
    Commented Apr 30, 2017 at 11:52
  • @pealo86 Unfortunately I have no experience with modifying the security level, perhaps someone else will be able to help with explaining any impacts this may have. As for opening with nano, this doesn't prevent access to the file, only modifications — try writing out with nano to the file?
    – grg ♦
    Commented Apr 30, 2017 at 11:54
  • ah I see what you mean about not being able to make modifications actually! it now gives me an error when I try to write-out the hosts file... that should do nicely then. Im struggling to undo the sudo chflags schg command however, if I run it again I am still unable to modify hosts?
    – user206728
    Commented Apr 30, 2017 at 12:00
  • @pealo86 By “previous command” I meant the noschg command I mention after — run sudo chflags noschg /etc/hosts to remove the protection.
    – grg ♦
    Commented Apr 30, 2017 at 12:06

You must log in to answer this question.