There is a host with a local service that receives data from a remote location (via e.g. http) and saves it locally under
/var/log/data/ in some mydir.
$ ls -al /var/log/data drwxr-sr-x+ 4 root datalog 4096 Feb 4 18:59 . drwxr-xr-x 4 root root 4096 Feb 4 18:59 .. drwxr-sr-x+ 2 root service 4096 Feb 4 19:07 mydir
The local service is run with service:service ownership.
Let's assume that I want to prevent execution of an exploit program that would
be found in
-rwxr-sr-x 1 root service 133156 Jul 19 2014 exploit
Note the "s" (setgid) bit on exploit file, which makes it execute with service group rights (the same as the local service).
How can I prevent potential exploit from being executed there ?
Removing "x" (go-x) from
/var/log/data/mydir ? It would probably disrupt service's work ... ?
Any other idea ?