noexec and bash

Stuart Green stuart.green at doccentrics.com
Thu Jul 3 16:11:14 UTC 2014


>> One of the hardening parameters we use to stop execution of programs on
>> certain partitions is noexec in fstab, this is a general C.I.S
>> requirement.  I believe the only requirement advising this in the
>> context of this list is to do with Removable Media Partitions.
> Generally you would want anywhere a program can be compiled because the
> directory is writable by anyone. For example, /tmp, /var/tmp, /dev/shm.
>
>
>> I've noted myself that you can still execute bash scripts in these
>> partitions by utilising /bin/sh  (bash),  in our environment /bin/sh is
>> set to -rwxr-xr-x which I belive is an OOB setting, should this be
>> refined to something more strict?
> Actually, you need to think about this a bit. The script is not executing, its
> being interpreted. The interpreter is executed. There is no way short of
> patching all interpreters to look at the partition flags to decide if it should
> interpret the script based on its path. Even so, you can have commands passed
> over stdin with cat and hide the location it comes from.
>
> So, I understand the concern but the reality is that its virtually impossible
> to lock down.
>
> -Steve
Thank's Steve, yep my terminology could have been a tad better by not 
utilising 'executed',  your summary is what I suspected might be the 
case though!

Cheers,
Stuart


More information about the scap-security-guide mailing list