Protect all executables, e.g. below /sbin, against tampering Common steps for all models

• Identify all directories containing executables and all single executables in other directories. As long as the most important directories, e.g. /sbin, /bin, /usr/sbin, /usr/bin, are included, you can find the rest with trial and error later.

1. Set ff_flags search_only and read_only for all identified directories. The flag search_only means that you can only access objects in a directory, if you know the exact path, and that you are not allowed to change anything about the directory itself.
2. Set read_only for all identified separate executables. The flag read_only means that the directory with all its subobjects is set to read-only.
3. If you need to read the directory contents, remove the search_only flag. The read_only flag is still applied.
4. If a directory contains binary executables only and no scripts, you can set the flag execute_only for it. This means that all files below may only be executed, but not read (copied) or anything else.

1. Create a new FD type 'Executables'.
2. Give all roles rights SEARCH and EXECUTE for this type.
3. If you need to READ_OPEN the files, e.g. scripts, add rights READ_OPEN and CLOSE.
4. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
5. Set the new FD type 'Executables' for all identified directories and files.
6. If you want to allow executable modification or installation for one role, e.g. 'Installer', just add the necessary rights to type 'Executables' for this role.

1. Set the inheritance mask to SEARCH and EXECUTE only for all identified directories and files.
2. If you need to READ_OPEN the files, e.g. scripts, add rights READ_OPEN and CLOSE.
3. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
4. As the SUPERVISOR right includes all other rights and can (usually) not be masked out, all subjects with SUPERVISOR on a higher level still have full access. In the standard setup, only user 400 (Security Officer etc.) has this right to the FD default ACL (and thus to all files and directories).
5. If you want to allow executable modification or installation for a subject, e.g. group 'Installers', just add an entry for this subject with the necessary rights to the directory or file ACL.
6. If you want to be sure not to miss such entries later, you can find all ACL entries with acl_tlist -r.