Hacker News new | ask | show | jobs
by josephcsible 592 days ago
Rules like https://cisofy.com/lynis/controls/HRDN-7222/ make me think the whole thing is snake oil. There is zero security benefit to making publicly-available compilers not be world-readable.
3 comments

> There is zero security benefit

I assume you don't work in security. The "HRDN" means it's a Hardening rule, and hardening is the action of reducing the attack surface for possible attacks as much as you can, even for the most crazy types, like a normal user or malware having access to download an exploit from exploit-db.com and being able to compile it without being root.

Preventing the compilation of code by arbitrary users is not harmful and reduces your attack surface.
Where does it say on that page that the hardening is not making them world-readable?

> If a compiler is found, execution should be limited to authorized users only (e.g. root user).

Unless you also mount some partitions noexec, making things not executable is useless. And if you have access to python/perl/ruby, you can construct any binary in memory anyway. And that's assuming someone's targeting some vulnerability chain which uses the compiler which is a stretch anyway.