[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#179125: maintainer scripts tries to exec script in /tmp

On Mon, 3 Feb 2003 13:39, Oliver Elphick wrote:
> > You shouldn't rely on your system working with noexec set on /tmp. A LOT
> > of software wants to run stuff in there.  Not too many Debian packages do
> > this, but...
> I still can't see how setting noexec on /tmp helps security.  You would
> still have to type an explicit path to execute any program, so it's no
> different from any other arbitrary path.  Is it intended to protect
> against people who put . in their path?

If you have an administrative policy which precludes users running their own 
executables then a noexec /tmp and /home are required.  Such a policy does 
not seem very sensible, as has been demonstrated you can run Perl and shell 
scripts regardless.

Such policies are best implemented by a proper security system such as SE 
Linux.  It would be very easy to write a SE policy which prohibits users from 
executing any file type that they can create, write to, or relabel to.  Such 
a policy could even be verified by IBM's policy verification tools (when they 
release them).

http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

Reply to: