documentation:administration_examples:protection_against_execution [RSBAC: Extending Linux Security Beyond the Limits]

Releases

Current version
Git/Latestdiff: 1.5.6

Latest Snapshots
Produced after each commit or rebase to new upstream version

GIT
RSBAC source code, can be unstable sometimes

Events

No events planned

Identify all directories containing executables and all single executables in other directories. Also, identify all directories containing dynamically linked libraries and all such single library files in other directories. As long as the most important directories, e.g. /sbin, /bin, /usr/sbin, /usr/bin, and files, e.g. /lib/*.so* and /usr/lib/*.so* are included, you can find the rest with trial and error later.

Attention: If you miss an important directory or file during identification or attribute setting, the system might become unaccessible, because important programs cannot be executed or important libraries cannot be mmapped for execution!

Remove add_inherited flag for all identified directories.
Remove add_inherited flag for all identified separate executables and libraries
Set no_execute flag on top dir
Without add_inherited, the no_execute flag is not inherited and thus not applied to the identified dirs and separate executables

Perform steps 1-5 from RC solution 2. Make a similar setup for library directories and files with another type 'Libraries'.
Remove EXECUTE and MAP_EXEC rights to all types other than 'Executables' and 'Libraries' from all roles. For setup checking, remove the right for your Role Admin last and first try other roles.

Grant rights SEARCH and EXECUTE to group 0 ('Everyone') for all identified directories and files.
If you need to READ_OPEN the files, e.g. libraries or scripts, add rights READ_OPEN and CLOSE.
For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
Remove right EXECUTE from the inheritance mask of the root dir / or from all entries in the default FD acl.
If you have individual ACL entries at any directory or file other than the identified ones, revoke EXECUTE right from them. You can find all ACL entries with acl_tlist -r.
As the SUPERVISOR right includes all other rights and can (usually) not be masked out, all subjects with SUPERVISOR still have full access. In the standard setup, only user 400 (Security Officer etc.) has this right to the FD default ACL (and thus to all files, fifos and directories).

//