Stopping executables on memory sticks

julianpb · 07-24-2006, 07:30 AM

Hi All,

I'm running a school network and we're trying stop people running .exe, .swf and other files from memory sticks via samba. Is there some way of setting a "don't execute" flag when the stick automounts?

Cheers,

Jools

anon237 · 07-24-2006, 07:56 AM

Hi,

You could use the noexec/-o noexec flag that mount supports.

Add this to the appropriate entry (entries) in the /etc/fstab, something like this:

Code:

/dev/sda1     /mnt/usbfs         auto      noexec,noauto,rw,user   0 0

See man mount for details.

Hope this helps.

Lotharster · 07-24-2006, 10:09 AM

You should be aware that you can't stop people from copying the file to their home directory and executing it there. If you want to disable that, you would have to mount the home partition with the noexec flag.
If you are only worried about windows executables, you could just uninstall wine.

woppa30 · 07-25-2006, 10:19 AM

An alternative but drastic method is to go around all the workstations, add an admin password to the BIOS and then disable all the USB ports. Bit of a killer if you use USB mice and keyboards but I have seen it done in a company to stop data theft via USB pen drives. Sorry I don't have a clever answer :-(
Woppa

unSpawn · 07-25-2006, 11:13 AM

You should be aware that you can't stop people from copying the file to their home directory and executing it there.
Yes you can and from about anywhere. GRSecurity contains Trusted Path Execution (TPE) which allows root to deny users executing stuff in dirs that are and not in $PATH, and not owned by root:root, and world-writable (IIRC). Spose one could do similar with any Rule Based Access solution (RBAC).