binary execute restrictions

[Matthew Seaman]

On Tue, Jan 13, 2004 at 03:52:49AM +0100, Jefferson San Juan wrote:
> How do I restrict normal users from executing their own compiled executable
> binary files?
> I use FreeBSD 4.9.

This is actually a very difficult problem: FreeBSD is designed to let
people run executables, not to stop them doing that...

Put all of the user home directories on a separate partition which you
mount with the noexec flag.

Make sure that the users have no write access to anywhere outside
their home directories.  This includes the various world writable
temporary directories /tmp, /var/tmp, etc.  However, not permitting
users to write files in /tmp or /var/tmp will lead to much wailing and
gnashing of teeth, because a lot of applications are going to break.

Investigate setting the TMPDIR environment variable either from
/etc/login.conf or else from /etc/csh.login (for tcsh(1) users) or
/etc/profile (for bash(1) or sh(1) users) to ameliorate that.  If you
set TMPDIR=${HOME}/tmp each user can have their own private temporary
area under their home directory.  Note however that this only has an
advisory effect: not all applications will obey $TMPDIR.

You can mount the shared temporary directories noexec -- which will
work exceeedingly well 99.9% of the time.  Investigate mounting /tmp
as a memory filesystem -- see mount_mfs(8) -- as a good way to do
that.  Symlink other shared temporary areas to your memory filesystem
if you don't want to have more than one.  Nb. One occasion doing this
will definitely cause problems is when you are updating your system by
'make installworld' -- however that is a sufficiently uncommon event
that you can feasibly do a temporary remount of /tmp without noexec in
that case.

Even so, a determined user could probably still work out ways to get
an executable executed, but they'd have to put some effort into
working out how.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040113/641e9387/attachment-0001.bin