[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Long Exim break-in analysis


On Tue Dec 21, 2010 at 23:07:37 +0100, Vladislav Kurz wrote:
> Lessons learned:
> 1. subscribe to DSA and run apt-get 
> 2. /var/spool, /var/tmp, /tmp and other places where unprivileged users can 
> write, should be mounted nosuid and even better noexec. It seems that this 
> could prevent the attack, or at least make it much more difficult. 
> As for point 2. it's a pity that dpkg is using /tmp and /var/lib/dpkg/ to run 
> scripts during installation and removal of packages. It would be nice if 
> whole /var could be mounted noexec.

# cat apt.conf.d/01remount
DPkg::Pre-Invoke {"if mount | awk '{print $3}' | grep -q '^/tmp$'; then /bin/mount -o remount,exec /tmp; fi";};
DPkg::Post-Invoke {"if mount | awk '{print $3}' | grep -q '^/tmp$'; then /bin/mount -o remount,noexec /tmp; fi";};

 Martin Zobel-Helas <zobel@debian.org>  | Debian System Administrator
 Debian & GNU/Linux Developer           |           Debian Listmaster
 Public key http://zobel.ftbfs.de/5d64f870.asc   -   KeyID: 5D64 F870
 GPG Fingerprint:  5DB3 1301 375A A50F 07E7  302F 493E FB8E 5D64 F870

Reply to: