"Root is God". Well, there are gods... and then, there are elder gods.
The root
user can do a lot of things on a machine. In particular, he can replace the files which are used to boot the machine; thus, he can potentially replace your kernel with another of his own, which would let him pass. SELinux can be used as a way to make a declawed, neutered root who will be limited in some ways, so no longer the real root
user; in particular, forcing any escape to go through a reboot of the machine. However, it is hard to block all paths and, arguably, the Linux kernel and SELinux are way too complex to be bug-free -- therefore, there MUST exist local exploits allowing at least root
to go in full-physical mode.
Also, there are devious ways to escape network filters. For instance, root
could access the network interface at the ethernet level and emit and receive ethernet frames by himself, completely bypassing the TCP/IP stack of the kernel, thus unaffected by any blocking filter you would have inserted at that level (and, for that matter, it would bypass iptables
as well).
To really contain root
, overawe him with heavy artillery. I mean a Virtual Machine. Make the Linux system run in a VM; all external network traffic to and from the VM will go through the VM manager system, which can then block and allow in any way as you see fit, completely outside of reach of the evil root
, regardless of what he does. This would even work if the evil root
replaced the whole system with NetBSD or Windows or anything else.
The VM arrangement requires that the VM is effective at containing the guest and preventing it from tapping into the host. This requires a bit of faith, but much less than believing that something as complex as SELinux or the Unix permission system could accomplish the same level of isolation reliability.