I'd like to cover the bases on a vulnerability which tries to download itself and save the result in a newly created directory inside the /tmp/ directory.

To be on the safe side, I wish to make it impossible to create folders inside /tmp/. Or if that is not feasible, I would like to prevent creating folders in just one specific directory inside /tmp.


use ls -l -d /tmp/ and you will see that the permissions are set to drwxrwxrwt, i.e. d: a directory, rwx: read, write and execute permissions allowed for owner, group and others (in this order), t sticky bit, i.e. only file owners are allowed to delete files (not the group despite permissions). Let's leave the sticky bit aside for the moment and mention that a directory needs to be executable for being accessible.

Now if you want to restrict write permission for others (owner and group is root) then use chmod o-w /tmp/ (as root, i.e. using sudo )

HOWEVER: /tmp/ is rather important for may processes that need temporary data, so I would suggest not to restrict permissions for this folder at all!

Since you are heading for a specific folder the simplest would be to manually create that folder (as root) and then restrict permission for it:

sudo mkdir /tmp/badfolder
sudo chmod -R o-w /tmp/badfolder/

Side note on chmod: -R do recursively, u,g,o: user,group,other , +- add/remove permission to r,w,x read,write,execute. I.e. for allowing gorup members to write to a file, use chmod g+w file.


In case the process is running as root, you also need to set the 'i' attribute. From man chattr

A file with the `i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

This would also apply if the folder was not owned by root. Simply use

chattr +i /tmp/badfolder

Use chattr -i /tmp/badfolder for removing it and -R for doing either recursively.

  • 4
    ... Unless the installer runs as root. Maybe add chattr? – Jeff Schaller Aug 10 '15 at 11:08
  • very good point, I updated the answer. – Fiximan Aug 10 '15 at 11:28
  • @Fiximan I already upvoted :p... I knew of the chmod command, but the chattr +i... (Glad I asked the question!) – Danielson Aug 10 '15 at 18:35
  • You could also just make it a symlink to itself. ln -s foo /tmp. touch /tmp/foo/bar: ... Too many levels of symbolic links. A rootkit is much less likely to try chattr than rm -rf /tmp/foo before creating its dir, though. – Peter Cordes Aug 11 '15 at 20:57
  • 1
    @JeffSchaller: chmod 000 would block any process that didn't rmdir it. – Peter Cordes Aug 11 '15 at 21:00

Alternatively to Fixman's idea, you could also just make it a symlink to itself.

sudo ln -s foo /tmp

$ touch /tmp/foo/bar
touch: cannot touch ‘/tmp/foo/bar’: Too many levels of symbolic links

sudo mkdir -m 000 /tmp/foo  # create with mode 000, no permissions at all.

Creating them as root will block non-root malware from removing / renaming them.

Mode 444 (read, but not write or execute) will prevent software from complaining that it can't list the directory, if you ls -R /tmp or equivalent.

A rootkit is much less likely to try chattr than rm -rf /tmp/foo before creating its dir, though.

  • are you sure about mode 444? shouldn't it rather be 555 for allowing to cd into the dir? – Fiximan Aug 12 '15 at 7:48
  • @Fiximan: I intentionally excluded that. du, find, etc., won't give errors, because they won't read any contents that they want to access inside the dir. Otherwise I'd make it 000. – Peter Cordes Aug 12 '15 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.