using acl instead of noexec mount option

[Alexandre Arents]

Hi all,

I read in few thread and manual that vxfs does'nt support noexec mount option.

In the following link, Florian Heigl said that he can avoid the file execution in /tmp with a little hack using acl:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=853550

But I am not able to do that,
we can setup a directory to disable execution flag when a file is created into that directory, but after the user can chmod a+x this file..

Maybe I misunderstood acl..

any idea ?

regards,
Alexandre

[Florian Heigl (new acc)]

I think I misunderstood ACLs capabilities myself. (And I only said I wanted to look into it *g*)

I hadn't expected a user could override the ACLs with a normal chmod, but I think this was more by a misconception of myself, I kind of expect the directory ACL to be propagated to a newly created file.
(And expect on NetWare this was a stupid assumption of mine)


On a side note, a few months I had a conversation with a friend concerning the use of noexec and he told me it's easily come by anyway using the shared library loader.
'easily' at least in his terms, and he actually studies that stuff ;)
I still think noexec would help fencing off the random kiddie, but it has less worth than I assumed.

FYI - I ran a apache2+php webserver on my hp box for over a year, and when it finally died it was due to a broken harddisk, not due to hackers.

the only security measures I took was
-disabling all unwanted modules
-having the webroot mostly readonly for the apache process
-chrooted apache (using the hp supplied script)
-non-priveledged apache on port 8080 and made available to port 80 by port forwarding
-php got it's own tmp directory inside the chroot

I'm sorry I don't have looked into the ACLs more, they're not in use at my workplace at all. :/

[Jakes Louw]

As far as I remember, HP-UX does not support ACLs on VxFS, only on standard HFS filesystems.

[Alexandre Arents]

Thank you to give me this explain.
I think I should search in an another way to meet my needs.

Jakes Louw, it seems that acl comes by default on hp-ux 11i with vxfs v4

regards,