Solved

Linux: /tmp noexec - useful or not?

Posted on 2013-01-26
3
616 Views
Last Modified: 2013-02-15
Hi,

Is there any benefit by mounting /tmp with noexec?
I've heard that even with that, there are workarounds to execute scripts in /tmp.

Is that true? If so, how is this possible?

Thank you
0
Comment
Question by:g0all
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 20

Assisted Solution

by:edster9999
edster9999 earned 250 total points
ID: 38822107
Its worth doing.
You should also set nodev and nosuid if possible.

Why would you do this ? Most vlaid users, whether they are a real user (like a person with an account on the machine) or a user that allows a process to run (like the user your webserver runs as) would have the ability to drop files into this folder and change things in there.  They can then cause it to be run either by themselves or by someone with more rights than them.
Adding these locks stop the commands being run so easily.  You have to use another step to get them to run.
Think of this as locking your house door.  You are saying you have heard there are other ways to get into a house so should you lock your doors.
Yes - of course you should, it may slow down or stop a script-kid from gaining root access to your server :)

How can people still run things ? Well there are at least a couple of different ways.
One of them involves not running it, but passing it as a parameter into another program (for example the bash shell).  Another way involves an older exploit using /lib/ld-linux.so to execute the code - but this has been patched on most Linuxes now.
No matter how much you patch - there will always still be holes that can be exploited. The best thing to do is patch and lock as many as are known.

Good luck
0
 
LVL 4

Expert Comment

by:ReN501
ID: 38829337
put simply , do it , /tmp is one of the very few folders or partitions ( default ) that has global read/write/execute access , by not allowing execute access this will prevent alot script kiddie attempts to run scripts etc, especially if your running a web server.
0
 
LVL 62

Accepted Solution

by:
gheist earned 250 total points
ID: 38853130
Yes - script interpreter like BASH or PERL will run any file passed as parameter to them, even if otherwise execve (you know that #!/bin/init 0 in front of file) would not work...
0

Featured Post

Want Experts Exchange at your fingertips?

With Experts Exchange’s latest app release, you can now experience our most recent features, updates, and the same community interface while on-the-go. Download our latest app release at the Android or Apple stores today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question