how to prevent executing script in /tmp ?
 

Hello all.

As you know, many attackers using /tmp for uploading exploit code.
and execute like below.

/usr/bin/perl /tmp/exploit.cgi or
/bin/sh /tmp/exploit.sh

so, even though I setup noexec at /tmp in /etc/fstab, attacker can avoid this config.

So is there any solution or method to prevent or monitoring using /tmp?



Thanks in advance.

You could write selinux policy to prevent script execution in /tmp

Why doesn't noexec work? If you're that worried, run a minimal chrooted system.

Because you don't need to execute the script. You can execute the interpreter (which will be on a non-noexec partition) and tell it which file to load the commands from, as shown in the OP's examples.

Could you post the steps to do that please?

That sounds bad!