News for hackers. Stuff that matters.
Re:Lynis – Security auditing and hardening tool, for Unix-ba... by josephcsible on Saturday November 09, 2024 @05:39PM (#42097359)
Rules like https://cisofy.com/lynis/controls/HRDN-7222/ make me think the whole thing is snake oil. There is zero security benefit to making publicly-available compilers not be world-readable.
Re:Lynis – Security auditing and hardening tool, for Unix-ba... by AbraKdabra on Saturday November 09, 2024 @07:11PM (#42097714)
> There is zero security benefit

I assume you don't work in security. The "HRDN" means it's a Hardening rule, and hardening is the action of reducing the attack surface for possible attacks as much as you can, even for the most crazy types, like a normal user or malware having access to download an exploit from exploit-db.com and being able to compile it without being root.

Re:Lynis – Security auditing and hardening tool, for Unix-ba... by HeatrayEnjoyer on Saturday November 09, 2024 @06:49PM (#42097639)
Preventing the compilation of code by arbitrary users is not harmful and reduces your attack surface.
Re:Lynis – Security auditing and hardening tool, for Unix-ba... by perlgeek on Sunday November 10, 2024 @02:48AM (#42098990)
Where does it say on that page that the hardening is not making them world-readable?

> If a compiler is found, execution should be limited to authorized users only (e.g. root user).

Re:Lynis – Security auditing and hardening tool, for Unix-ba... by viraptor on Sunday November 10, 2024 @04:11AM (#42099214)
Unless you also mount some partitions noexec, making things not executable is useless. And if you have access to python/perl/ruby, you can construct any binary in memory anyway. And that's assuming someone's targeting some vulnerability chain which uses the compiler which is a stretch anyway.