1

NIST 800-53 rev 4 CM-7(2) states:

(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (one or more): authorized software programs; unauthorized software programs; rules authorizing the terms and conditions of software program usage].

What automated mechanisms exist in Linux to prevent specific program(s) execution? I understand Linux DAC permissions can be used at a high level to restrict execution of all programs, but that is not whitelist/blacklist implementation. I'm also aware that a strict policy implementation of SELinux could be used to satisfy a white list by requiring policies to be definied for every application that is approved. Are there any other options that are less onerous than SELinux strict policy (which is a considerable effort to implement in a strict policy configuration)?

1

There are a few ways to prevent execution on Linux. It is important to remember, though, that these only apply to binary executables (like ELFs). Scripts or any other interpreted files cannot be blocked in the same way. For example, a bash script isn't actually executed, it is merely read by /bin/bash, which parses it. The same goes with something like python, where /usr/bin/python reads and interprets a python file. Blocking execution of the scripts will prevent one from doing ./file.sh, but you will still be able to do /bin/bash file.sh, unless the bash executable itself is blocked. As such, any programs which act as interpreters can bypass these protections.

A few ways to block execution:

  • Setting the noexec mount flag prevents execution on an entire partition.

  • DAC can be used on a blacklist basis, by removing the executable flag on a file.

  • AppArmor, and many other MACs, can be used to whitelist individual files for execution.

Note that AppArmor by default only applies to programs you create a policy for. There are ways to use a global profile so whitelists for each program are required, but it is not officially supported.

It looks like what you want is a MAC, just one simpler than SELinux.

  • DAC is only able to disable execution of existing files. You can't maintain a blacklist of files not already on the file system? – positive return Nov 22 '17 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.