A study on the effectiveness of read-only root filesystems in mitigating persistent malware threats

الملخص

Persistent malware poses a serious challenge to operating systems due to its ability to remain active within a system over extended periods, even after reboot. This persistence enables sustained unauthorized access to system resources and data. In most cases, such behavior depends on the ability to introduce lasting modifications to system files—an inherent characteristic of traditional mutable systems. This highlights the need for approaches that address persistence at the system design level, rather than relying solely on detection after compromise.

This paper investigates the effectiveness of enforcing a read-only root filesystem as a means of limiting persistence. To this end, a controlled experimental setup was implemented using a container-based environment. Two configurations were examined: a standard mutable system and a second configuration designed to emulate immutability by enforcing read-only access to the root filesystem. A simple persistence-oriented scenario was used, in which attempts were made to write files into system directories.

The observations were consistent across all trials. In the mutable configuration, write operations targeting system directories such as /etc were successful, allowing modifications to remain after execution. In contrast, the read-only configuration prevented all such attempts, effectively blocking the introduction of persistent changes.

These results suggest that restricting write access at the filesystem level can significantly limit the ability of malware to establish persistence. While this approach does not eliminate all possible attack vectors, it directly constrains one of the primary mechanisms used to maintain long-term presence within a system.