6

I'd like to cover the bases on a vulnerability which tries to download itself and save the result in a newly created directory inside the /tmp/ directory.

To be on the safe side, I wish to make it impossible to create folders inside /tmp/. Or if that is not feasible, I would like to prevent creating folders in just one specific directory inside /tmp.

1

2 Answers 2

9

use ls -l -d /tmp/ and you will see that the permissions are set to drwxrwxrwt, i.e. d: a directory, rwx: read, write and execute permissions allowed for owner, group and others (in this order), t sticky bit, i.e. only file owners are allowed to delete files (not the group despite permissions). Let's leave the sticky bit aside for the moment and mention that a directory needs to be executable for being accessible.

Now if you want to restrict write permission for others (owner and group is root) then use chmod o-w /tmp/ (as root, i.e. using sudo )

HOWEVER: /tmp/ is rather important for may processes that need temporary data, so I would suggest not to restrict permissions for this folder at all!

Since you are heading for a specific folder the simplest would be to manually create that folder (as root) and then restrict permission for it:

sudo mkdir /tmp/badfolder
sudo chmod -R o-w /tmp/badfolder/

Side note on chmod: -R do recursively, u,g,o: user,group,other , +- add/remove permission to r,w,x read,write,execute. I.e. for allowing gorup members to write to a file, use chmod g+w file.


Update:

In case the process is running as root, you also need to set the 'i' attribute. From man chattr

A file with the `i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

This would also apply if the folder was not owned by root. Simply use

chattr +i /tmp/badfolder

Use chattr -i /tmp/badfolder for removing it and -R for doing either recursively.

5
  • 4
    ... Unless the installer runs as root. Maybe add chattr?
    – Jeff Schaller
    Aug 10, 2015 at 11:08
  • very good point, I updated the answer.
    – FelixJN
    Aug 10, 2015 at 11:28
  • @Fiximan I already upvoted :p... I knew of the chmod command, but the chattr +i... (Glad I asked the question!)
    – Danielson
    Aug 10, 2015 at 18:35
  • You could also just make it a symlink to itself. ln -s foo /tmp. touch /tmp/foo/bar: ... Too many levels of symbolic links. A rootkit is much less likely to try chattr than rm -rf /tmp/foo before creating its dir, though. Aug 11, 2015 at 20:57
  • 1
    @JeffSchaller: chmod 000 would block any process that didn't rmdir it. Aug 11, 2015 at 21:00
2

Alternatively to Fixman's idea, you could also just make it a symlink to itself.

sudo ln -s foo /tmp

$ touch /tmp/foo/bar
touch: cannot touch ‘/tmp/foo/bar’: Too many levels of symbolic links

#Or
sudo mkdir -m 000 /tmp/foo  # create with mode 000, no permissions at all.

Creating them as root will block non-root malware from removing / renaming them.

Mode 444 (read, but not write or execute) will prevent software from complaining that it can't list the directory, if you ls -R /tmp or equivalent.

A rootkit is much less likely to try chattr than rm -rf /tmp/foo before creating its dir, though.

2
  • are you sure about mode 444? shouldn't it rather be 555 for allowing to cd into the dir?
    – FelixJN
    Aug 12, 2015 at 7:48
  • @Fiximan: I intentionally excluded that. du, find, etc., won't give errors, because they won't read any contents that they want to access inside the dir. Otherwise I'd make it 000. Aug 12, 2015 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .