Is there any way to disallow file execution from home director in Linux? My target is to protect my system from malicious scripts etc. Sure, I can remove execution bit with chmod for /home/user and all its subdirectories but it easy could be changed since user is owner of /home/user. So I think about enabling execution from bin, /usr/bin, usr/sbin only and disallow execution from other directories. My system is Debian 8.
if
/homeis a separate partition, you can mount it with thenoexecoption.By doing this, you are destroying (or attempting to) much of the functionality of a unix system for your users as it disables ALL user-written scripts, not just "malicious" ones. Writing scripts to get stuff done is a perfectly normal thing for unix users to do.
It still doesn't stop them from writing scripts and executing them with
bash myscript.shorperl myscript.pletc.If you don't have at least minimal trust in your users, don't give them a shell, or give them a restricted shell such as
/bin/rbashinstead of/bin/bash.
-
yes, you are right, I've forget about 3. Actually I was talking about my working machine so there isn't other users. All I want to do is protect my system and mostly my home directory from malicious scripts that can get onto a machine via the browser etc. – folibis Nov 23 '15 at 0:09
-
Run NoScript and AdBlock Plus in your browser. Or similar if you're not using firefox/iceweasel. Only allow web sites that you trust and need and won't work without scripting to run scripts. e.g. StackExchange is one of the very few sites that I allow to run scripts on my system (and even then well-known advertising and spyware script URLs are still blocked)....but the default is that scripts are disabled until I explicitly enable them for a site. – cas Nov 23 '15 at 0:15
-
1You can still use
noexeceven if it is on the same file system:mount --bind /home /home && mount -o remount,noexec /home– kasperd Nov 23 '15 at 7:50 -
1About #3 even if there was no place that user could put any file, executable or not, a script could still be executed by making an interpreter receive it from stdin (eg by downloading it with curl, receiving it with a netcat listener,....) – rackandboneman Nov 23 '15 at 11:03
-
1If it is a server or otherwise important machine, do not use any Internet browser on it! – h22 Nov 23 '15 at 11:06
A way this could be done is setting up a limited shell for the user - for example using lshell. See also restricted shell.
Basically you setup there login shell to be /usr/bin/lshell instead of bash, then you can configure it via /etc/lshell.conf for each user to allow only some stuff to be executed.
However, this may break most programs available to a user without extended configuration - also some programs can be made to execute custom commands which probably could be used to get out of limited shell.
So if you have the correct permissions set on the system (and no sudo access, see also what polkit allows), they should be able to use the standard login shell without affecting the rest of system.
N.B. another method I know where untrusted users have access to systems is to reimage the entire system every day or so. Not very practical for most cases though.
sh myscript? – RobAu Nov 13 '17 at 10:06