Re: Mounting filesystems with "noexec"
--2fHTh5uZTiUOsy+g
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On 2005.09.22 13:11:43 +0200, Borja Marcos wrote:
> I've been playing a bit with the "noexec" flag for filesystems. It
> can represent a substantial obstacle against the exploitation of
> security holes.
Please note the following from the mount(8) manual page:
noexec Do not allow execution of any binaries on the mounted
file system. This option is useful for a server that has
file systems containing binaries for architectures other
than its own. Note: This option was not designed as a
security feature and no guarantee is made that it will
prevent malicious code execution; for example, it is
still possible to execute scripts which reside on a
noexec mounted partition.
I don't know if it makes sense to log noexec failures, but at least
it's important that people don't completely rely on noexec for
security.
--=20
Simon L. Nielsen
--2fHTh5uZTiUOsy+g
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)
iD8DBQFDMp/mh9pcDSc1mlERAnLOAJ0WqGjhfVfyTTwW4bdBrCWSxI7/3ACggZVD
YBe2yVRDSJQcW0PPckKsSdc=
=wk35
-----END PGP SIGNATURE-----
--2fHTh5uZTiUOsy+g--
討論串 (同標題文章)
完整討論串 (本文為第 4 之 8 篇)：