Printable View
I am looking to find an equivalent to Software Restriction Policies in Windows, for Open source distributions. Nothing platform specific, I just want to see what is out there. Does anyone know of anything similar?
Here's the link
http://technet.microsoft.com/en-us/l.../bb457006.aspx
Findings would be discussed in a research paper, thanks :)
CHMOD.
Only allow a certian group to read/execute it, Done.
Unfortunately chmod wont stop a user from executing an altered binary they had +x permissions on. Also SRP can deny anything but the installation of signed and approved software. So in short... what happens when a user executes code they loaded themselves? ;)
found this (ironic it's on this site)
http://antionline.com/archive/index.php/t-272351.html
however I think SRP applies to scripts but I'm not quite sure.
If you used SPR to disable users from running scripts they wouldnt be able to run scripts. They also wont be able to install programs because they are not root.
Yes, isn't it great :)Quote:
If you used SPR to disable users from running scripts they wouldnt be able to run scripts.
Yes, they could, with permission and a signed installer. It's all in the article :D. Or are we still talking about linux?Quote:
They also wont be able to install programs because they are not root.
Yer Im talking about linux. Hmm an answer must be out there...
school must have let out for summer. I noticed you have successfully spammed the entire front page with your posts. :drink:
Its been out :-p
Only root can install software.Quote:
Originally Posted by d34dl0k1
To prevent users from installing/running software from their homedirs mount /home noexec. Might want to mount /tmp noexec too.Quote:
So in short... what happens when a user executes code they loaded themselves? ;)
are you saying if a user has access to vim and gcc, can they not compile and run software? though I suppose if everything they have access to is noexec...
Yes, they can still compile their programs. But because of the noexec bit they cannot execute the resulting binary (or scripts for that matter).
If you're that worried about your security I highly recommend removing gcc from production machines.
I agree.... 'chmod' does all my job for my machine which is frequently shared with my friends. they try all they can to delete or modify contents from a directory which is shared but read only. There are some softwares in that directory for my use but thay cannot execute it.
Even though this is of course not a n enetreprise scenario, but then it is all the same case. 'chmod' is good enough to protect the files.