Linux partition security recommendations

sulekha · 10-25-2012, 11:44 AM

Hi all,

I was viewing a computer security related tutorial , in it it is said that from a security standpoint partitions should be mounted as follows :-

http://s529.photobucket.com/albums/d...uth-users1.png

How correct/practical is this recommendation

unSpawn · 10-25-2012, 05:10 PM

Quote:

Originally Posted by sulekha

I was viewing a computer security related tutorial

Which one?

Quote:

Originally Posted by sulekha

, in it it is said that from a security standpoint partitions should be mounted as follows :-

Did it say what that would protect against?
Did you check those mount options with what 'man mount' says?
Did you check which applications in /usr have setuid / setgid set (/home and /tmp shouldn't contain binaries anyway)?
Did it say what it would not protect against?

You can also temporarily mount the partitions to see what happens. This should not cause any permanent damage and to reset simply use "-o remount" w/o args:

Code:

grep dev/ /proc/mounts | while read dev mp fs args; do
 case "$mp" in 
  /usr|/tmp|/home) 
    mount $mp -o remount noexec,nosuid,$args
  ;; 
 esac; 
done

rknichols · 10-25-2012, 06:14 PM

Quote:

Originally Posted by unSpawn

/home and /tmp shouldn't contain binaries anyway

So, where would you suggest an aspiring programmer should compile and execute his "Hello world" program if his personal machine is set up according to those recommendations?

unSpawn · 10-25-2012, 06:30 PM

Quote:

Originally Posted by rknichols

So, where would you suggest an aspiring programmer should compile and execute his "Hello world" program if his personal machine is set up according to those recommendations?

That's an exception but a good one to note, thanks. It's also the reason I suggested the OP test things before making it permanent.

sulekha · 10-26-2012, 01:58 PM

[QUOTE=unSpawn;4814981]Which one?

It was a tutorial by bobby rogers

JaseP · 10-26-2012, 02:20 PM

Quote:

Originally Posted by rknichols

So, where would you suggest an aspiring programmer should compile and execute his "Hello world" program if his personal machine is set up according to those recommendations?

The /home partition is also a reasonable place to put binaries from sources that you have ANY doubts about (i.e.: Games, binary apps for VOIP that want to turn you machine into a super node, etc.).

On multi-user systems, especially, many userland programs would reside in the user account directories of their users in /home.

linosaurusroot · 11-01-2012, 07:38 AM

The noexec mount option is not a security feature. -- Michael K. Johnson

http://www.shmoo.com/mail/bugtraq/aug99/msg00342.html

unSpawn · 11-01-2012, 08:46 AM

Quote:

Originally Posted by JaseP

binaries from sources that you have ANY doubts about (..) On multi-user systems, especially, many userland programs would reside in the user account directories of their users in /home.

I'm not sure if you're aware of it but being able to introduce and run foreign binaries are what some classic compromises are made of. The fact its run from a users /home means nothing if that is all a local exploit needs. IMNSHO one simply should not run suspicious binaries unless using VM to sandbox it.

Apart from mount flags theres Trusted Path Execution, a feature unique to GRSecurity AFAIK, denying users one specific avenue to cause FOD.