Cisco AnyConnect on Linux disable resolv.conf update

Question

Is there any way to prevent Cisco AnyConnect client to update /etc/resolv.conf on a GNU/Linux box?

Answer 1

Newer versions of AnyConnect (above 4.3.05017 as mentioned by @David G) fails when not being able to modify /etc/resolv.conf.

What worked for me was to modify the binary of /opt/cisco/anyconnect/bin/vpnagentd and change the occurrence of/etc/resolv.conf inside the file to something else (I chose to change only one letter in it to /etc/Xesolv.conf).

In version 4.8.03043 the string is located at offset 817635 so something like:

echo -n "X" | dd of=/opt/cisco/anyconnect/bin/vpnagentd bs=1 seek=817635 count=1 conv=notrunc

would work.

However following python3 script should possibly do the trick on future versions. Be sure to make a copy of vpnagentd file just in case as it modifies it in place.

#!/usr/bin/env python3

import re

filename="/opt/cisco/anyconnect/bin/vpnagentd"
# find occurence of C string resolv.conf (enging with 0 byte)
find=rb'resolv\.conf\00'
# replacement  byte(s), we change only the first letter to X
replace=rb'X'

with open(filename,"rb") as binfile:
    bincontent=binfile.read()

match = re.search(find,bincontent)

offset=match.start()
print(f"Found at offet {offset}")

with open(filename, 'rb+') as binfile:
    binfile.seek(offset)
    print(binfile.read(1))
    binfile.write(replace)

Make sure to stop vpnagentd service (e.g. systemctl stop vpnagentd) or you'll get:

OSError: [Errno 26] Text file busy: '/opt/cisco/anyconnect/bin/vpnagentd'

When run successfully it should output something like:

$ sudo ./patch.py
Found at offet 817635
b'r'

any subsequent run would not find the pattern pattern (and that's OK) and fail with:

$ sudo ./patch.py
Traceback (most recent call last):
  File "./patch.py", line 16, in <module>
    offset=match.start()
AttributeError: 'NoneType' object has no attribute 'start'

Answer 2

This was answered over SuperUser, essentially just make the file immutable

Set the content of /etc/resolv.conf however you want and then set it immutable with command chattr +i /etc/resolv.conf.

I would suggest adding a note to the file indicating that you have set it immutable before you set it immutable, to prevent future confusion.