An administrator notices the following file in the Linux server's /tmp directory. -rwsr-xr-x. 4 root root 234223 Jun 6 22:52 bash* Which of the following should be done to prevent further attacks of…

The correct answer is C. Mount all tmp directories nosuid, noexec. The file listing shows a bash binary (-rwsr-xr-x) in /tmp with the SUID bit set (the 's' in the owner execute field) and owned by root. This is a classic privilege escalation technique: an attacker places a SUID root shell in /tmp so any user can execute it and gain root…

Technical Integration of Enterprise Components

Question

An administrator notices the following file in the Linux server's /tmp directory. -rwsr-xr-x. 4 root root 234223 Jun 6 22:52 bash* Which of the following should be done to prevent further attacks of this nature?

Options

ANever mount the /tmp directory over NFS
BStop the rpcidmapd service from running
CMount all tmp directories nosuid, noexec
DRestrict access to the /tmp directory

How the community answered

(19 responses)

A
5% (1)
B
11% (2)
C
68% (13)
D
16% (3)

Explanation

The file listing shows a bash binary (-rwsr-xr-x) in /tmp with the SUID bit set (the 's' in the owner execute field) and owned by root. This is a classic privilege escalation technique: an attacker places a SUID root shell in /tmp so any user can execute it and gain root privileges. Mounting /tmp with the nosuid option prevents the operating system from honoring SUID/SGID bits on any file in that directory, neutralizing this attack vector. Adding noexec further prevents any binary from being executed directly from /tmp. This is a defense-in-depth measure at the filesystem level and the most effective systemic control against this class of attack.

Topics

#Linux filesystem#SUID bit#privilege escalation#mount options

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice