Can I configure Ubuntu to remove apt-get and dpkg?

Question

I need to completely remove any methods for making changes to my system. Is there a way to remove apt-get and dpkg? Is it possible to also disallow changing executable bit to any files copied into my system? Can this be done with a mask?

I'd agree that limiting sudo & user permissions to disallow changes is the way to go. Treat it like a multi-user system where only you can make changes, &/or a "kiosk mode"? Unless you don't want yourself making changes...? Then a live CD/DVD would really not allow changes to survive a reboot, though the system can be changed while running — Xen2050, Mar 14 '14 at 13:49
Please tell us what your ultimate goal is, why you want to do that. — guntbert, Mar 14 '14 at 20:34
Why would you exactly need to remove dpkg or apt-get. Once removed you can't go back. — Braiam, Mar 15 '14 at 00:35

score 5 · Answer 1 · edited Apr 13 '17 at 12:24

5

You could remove the execute bit from apt-get and dpkg;

chmod -x $(which apt-get)
chmod -x $(which dpkg)

Be aware that this will disable updates. Also, you could mount the drive read-only.

edited Apr 13 '17 at 12:24

Community

1

answered Mar 14 '14 at 13:25

Elliott Frisch

3,018

score 0 · Answer 2 · edited Apr 18 '14 at 16:15

I think with the advent of functional "micro" deployments using LXC and Docker that this might become increasingly relevant.

I can think of reasons why I would create a bash environment in a container, put utilities in it that require to be run as root, make a variety of devices available to the container by having it launch in privileged mode, but NOT want the user of that container to add any new software.

With the layered revisions of containers - then "once removed you can't go back" is not true. I can iterate on my docker utility container - but deliver it in "final" form.

USE AT YOUR OWN RISK (and I wouldn't recommend this other than in docker style work): At least in Precise you can apt-get remove apt leading to this interaction below:

apt-get remove apt 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be REMOVED:
  apt ubuntu-minimal
WARNING: The following essential packages will be removed.
This should NOT be done unless you know exactly what you are doing!
  apt
0 upgraded, 0 newly installed, 2 to remove and 57 not upgraded.
After this operation, 3300 kB disk space will be freed.
You are about to do something potentially harmful.
To continue type in the phrase 'Yes, do as I say!'
 ?] Yes, do as I say!

(now of course if scp or other file transfer programs are available to the container, someone can fiddle this all back in.)

Can I configure Ubuntu to remove apt-get and dpkg?

2 Answers2