[ start | index | login ]
start > knowledgebase > linux > webserver > noexec tmp

noexec tmp

Created by retep. Last edited by alicia, one year and 145 days ago. Viewed 3,372 times. #6
[diff] [history] [edit] [rdf]
labels
attachments
Do you have a 'broken' web application that let's hackers upload files to /tmp and execute them? Here is how to prevent programs uploaded to /tmp from running.

# create a 10MB block device which will be the /tmp file system
cd /root
dd if=/dev/zero of=/root/tmpMnt bs=1024 count=10000
mkfs.ext3 -F /root/tmpMnt
# mount it at /tmp
mv /tmp /tmp.backup
mkdir /tmp
mount -o loop,noexec,nosuid,rw /root/tmpMnt /tmp
chmod 0777 /tmp
# make it so it is used on boot up
if ! grep -qai tmpMnt /etc/fstab ; then 
     echo "/root/tmpMnt /tmp ext3 loop,noexec,nosuid,rw  0 0" >> /etc/fstab
fi
# check your syntax is ok
mount -a
# check that programs in /tmp will not run
cp /bin/ls /tmp/
/tmp/ls
2 comments (by yves, alicia) | post comment
Powered by snipsnap.org Found a mistake in a howto? Let us know via an email to p.blikibugs at rimuhosting com.