5

Is there any way to disallow file execution from home director in Linux? My target is to protect my system from malicious scripts etc. Sure, I can remove execution bit with chmod for /home/user and all its subdirectories but it easy could be changed since user is owner of /home/user. So I think about enabling execution from bin, /usr/bin, usr/sbin only and disallow execution from other directories. My system is Debian 8.

  • You would have to do the same to /tmp and /var/tmp at least... – rackandboneman Nov 23 '15 at 10:58
  • 1
    Oh, and are we talking about a desktop user (as would appear from your description) or a user running a service (which you could restrict far, far more without breaking functionality)? – rackandboneman Nov 23 '15 at 11:00
  • While I'm not sure I support the premise of the question, another option may be SELinux – Jeff Schaller Nov 23 '15 at 17:54
  • How would this add security? There is always sh myscript? – RobAu Nov 13 '17 at 10:06
20
  1. if /home is a separate partition, you can mount it with the noexec option.

  2. By doing this, you are destroying (or attempting to) much of the functionality of a unix system for your users as it disables ALL user-written scripts, not just "malicious" ones. Writing scripts to get stuff done is a perfectly normal thing for unix users to do.

  3. It still doesn't stop them from writing scripts and executing them with bash myscript.sh or perl myscript.pl etc.

  4. If you don't have at least minimal trust in your users, don't give them a shell, or give them a restricted shell such as /bin/rbash instead of /bin/bash.

  • yes, you are right, I've forget about 3. Actually I was talking about my working machine so there isn't other users. All I want to do is protect my system and mostly my home directory from malicious scripts that can get onto a machine via the browser etc. – folibis Nov 23 '15 at 0:09
  • Run NoScript and AdBlock Plus in your browser. Or similar if you're not using firefox/iceweasel. Only allow web sites that you trust and need and won't work without scripting to run scripts. e.g. StackExchange is one of the very few sites that I allow to run scripts on my system (and even then well-known advertising and spyware script URLs are still blocked)....but the default is that scripts are disabled until I explicitly enable them for a site. – cas Nov 23 '15 at 0:15
  • 1
    You can still use noexec even if it is on the same file system: mount --bind /home /home && mount -o remount,noexec /home – kasperd Nov 23 '15 at 7:50
  • 1
    About #3 even if there was no place that user could put any file, executable or not, a script could still be executed by making an interpreter receive it from stdin (eg by downloading it with curl, receiving it with a netcat listener,....) – rackandboneman Nov 23 '15 at 11:03
  • 1
    If it is a server or otherwise important machine, do not use any Internet browser on it! – h22 Nov 23 '15 at 11:06
3

A way this could be done is setting up a limited shell for the user - for example using lshell. See also restricted shell.

Basically you setup there login shell to be /usr/bin/lshell instead of bash, then you can configure it via /etc/lshell.conf for each user to allow only some stuff to be executed.

However, this may break most programs available to a user without extended configuration - also some programs can be made to execute custom commands which probably could be used to get out of limited shell.

So if you have the correct permissions set on the system (and no sudo access, see also what polkit allows), they should be able to use the standard login shell without affecting the rest of system.

N.B. another method I know where untrusted users have access to systems is to reimage the entire system every day or so. Not very practical for most cases though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.