0

I noticed this weird issue in a Ubuntu 18.04 (Bionic Beaver) box and a couple of other Debian-based systems -- I will take statically linked netcat binary (a unix networking tool) for the sake of demonstration, however the result is the same for any other ELF executable.

Executing it gives the following message (from any normal directory such as /tmp):

/tmp$ ./nc
-bash: ./nc: Permission denied

The permissions with chmod are correct for execute permissions:

/tmp$ ls -lah nc
-rwxr-xr-x 1 user user 2.8M May 19 19:38 nc

I have tried lots of combinations, but none worked, until a friend of mine suggested that I put the binary in /var/lib/php/session (where PHPSESSIDs reside) and it works:

/var/lib/php/session$ ./nc
Ncat: You must specify a host to connect to. QUITTING.

However, I have not been able to find an explanation for this yet, and php is not present in every system, so what do I do in that case?

  • 1
    There are much more "normal" directories than /tmp. – Rui F Ribeiro May 19 '19 at 21:39
  • @RuiFRibeiro I tried a bunch of them (home dir., /dev/shm, etc.), but without any luck. Only /var worked till now. And by "normal" I mean the ones which I have write permissions as that particular user. – bashbin May 19 '19 at 21:40
4

This happens when /tmp is mounted with the noexec flag, which is probably the case on your system — see the output of mount. This prevents any executable stored under /tmp from running, regardless of the file’s permissions. The idea behind mounting /tmp, and other world-writable directories, with this setting is to make it harder to drop binaries on your system and execute them.

Any directory in a volume mounted without noexec (such as /var, in most cases) can be used to store executables you wish to run. Which directory you should use depends on your exact use-case.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.