Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-05-04 19:14:59 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #249 from raja-grewal/binfmt_misc

Browse source 
Disallow registering interpreters for miscellaneous binary formats
This commit is contained in:
Patrick Schleizer 2024-08-16 02:43:57 -04:00 • committed by GitHub
commit ef60c5b153
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
usr/lib/sysctl.d/990-security-misc.conf
View file

@ -214,6 +214,26 @@ fs.protected_regular=2
##
vm.max_map_count=1048576
## Disable the miscellaneous binary format virtual file system to prevent unintended code execution.
## Prevents registering interpreters for various binary formats based on a magic number or their file extension.
## Otherwise arbitrary executables with recognized file formats will be passed to relevant user space applications.
## These interpreters will then run with root permissions when a setuid binary is owned by root.
## Can stop maliciously crafted files with specific file extensions from automatically executing.
## Breaks many scripts that do not have appropriate shebang interpreter directives (#!/bin/...).
##
## https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html
## https://salsa.debian.org/debian/binfmt-support
## https://access.redhat.com/solutions/1985633
## https://en.wikipedia.org/wiki/Binfmt_misc
## https://security.stackexchange.com/questions/271786/does-allowing-binfmt-misc-significantly-increase-the-attack-surface-for-unprivil
## https://unix.stackexchange.com/questions/439569/what-kinds-of-executable-formats-do-the-files-under-proc-sys-fs-binfmt-misc-al
## https://github.com/Kicksecure/security-misc/pull/249
##
## KSPP=yes
## KSPP does not set CONFIG_BINFMT_MISC.
##
fs.binfmt_misc.status=0
## 3. Core Dumps:
##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#core-dumps