On Thursday, July 03, 2014 04:21:05 PM Stuart Green wrote:
One of the hardening parameters we use to stop execution of programs
certain partitions is noexec in fstab, this is a general C.I.S
requirement. I believe the only requirement advising this in the
context of this list is to do with Removable Media Partitions.
Generally you would want anywhere a program can be compiled because the
directory is writable by anyone. For example, /tmp, /var/tmp, /dev/shm.
I've noted myself that you can still execute bash scripts in
partitions by utilising /bin/sh (bash), in our environment /bin/sh is
set to -rwxr-xr-x which I belive is an OOB setting, should this be
refined to something more strict?
Actually, you need to think about this a bit. The script is not executing, its
being interpreted. The interpreter is executed. There is no way short of
patching all interpreters to look at the partition flags to decide if it should
interpret the script based on its path. Even so, you can have commands passed
over stdin with cat and hide the location it comes from.
So, I understand the concern but the reality is that its virtually impossible
to lock down.