Re: possible mass-filing of bugs: many shared library packages contain binaries in usr/bin
Joseph Carter <knghtbrd@bluecherry.net> writes:
> On Tue, May 07, 2002 at 04:26:32PM -0500, Manoj Srivastava wrote:
> > Indeed, the one pro of having libexec that no one seems to
> > have mentioned is mount options: if /etc/libexec is a separate file
> > system, I can mount /lib with noexec, and only have the exec mount
> > flag for libexec, and it adds a little more hassles to a croacker who
> > has broken in. I am not sure whether this is enough to succefully
> > advocate for the inclusion of libexec.
>
> The problem with this benefit is the small number of people who would
> directly benefit from it - how many people do you know with seperate
> partitions for /usr/lib? I don't know many. Although, from a purely
> paranoia standard, I can envision creating one for this very purpose and
> think it is worth considering for that purpose. Having sheer paranoia
> levels of security being available to those who would use them is a goal I
> think we can all agree is not a bad thing.
With a 2.4 kernel, you shouldn't need a separate partition:
# mount --bind -o ro,noexec /lib /lib
# mount --bind -o ro,noexec /usr/lib /usr/lib
Bind mounting /usr/lib directly on top of itself with different mount
options, you can achieve the same effect (I previously used it to set
default filesystem umasks within certain directories). Hmm, after
trying this out, it doesn't seem to work like it does for umasks (I
can still run /lib/ld-linux.so.2), possibly a mount bug?
--
Roger Leigh
** Registration Number: 151826, http://counter.li.org **
Need Epson Stylus Utilities? http://gimp-print.sourceforge.net/
GPG Public Key: 0x25BFB848 available on public keyservers
--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: