Re:Lynis – Security auditing and hardening tool, for Unix-ba...
by josephcsible on Saturday November 09, 2024 @05:39PM
(#42097359)
Rules like https://cisofy.com/lynis/controls/HRDN-7222/ make me think the whole thing is snake oil. There is zero security benefit to making publicly-available compilers not be world-readable.
[ Parent
| on HN ]
Re:Lynis – Security auditing and hardening tool, for Unix-ba...
by AbraKdabra on Saturday November 09, 2024 @07:11PM
(#42097714)
> There is zero security benefit
I assume you don't work in security. The "HRDN" means it's a Hardening rule, and hardening is the action of reducing the attack surface for possible attacks as much as you can, even for the most crazy types, like a normal user or malware having access to download an exploit from exploit-db.com and being able to compile it without being root.
Re:Lynis – Security auditing and hardening tool, for Unix-ba...
by HeatrayEnjoyer on Saturday November 09, 2024 @06:49PM
(#42097639)
Preventing the compilation of code by arbitrary users is not harmful and reduces your attack surface.
Re:Lynis – Security auditing and hardening tool, for Unix-ba...
by perlgeek on Sunday November 10, 2024 @02:48AM
(#42098990)
Where does it say on that page that the hardening is not making them world-readable?
> If a compiler is found, execution should be limited to authorized users only (e.g. root user).
Re:Lynis – Security auditing and hardening tool, for Unix-ba...
by viraptor on Sunday November 10, 2024 @04:11AM
(#42099214)
Unless you also mount some partitions noexec, making things not executable is useless. And if you have access to python/perl/ruby, you can construct any binary in memory anyway. And that's assuming someone's targeting some vulnerability chain which uses the compiler which is a stretch anyway.