4 ms·

you mean like you checking out some repository from github or you unzipping a file that you downloaded or ...?

• fiddlerwoaroof 7y ago
  Mount those directories noexec
  • marcosdumay 7y ago
    Most people want to execute things on their homedir.
    • fiddlerwoaroof 7y ago
      I usually mount a separate file system on ~/Downloads
      • DonHopkins 7y ago
        You really are missing the point. https://web.mit.edu/~simsong/www/ugh.pdf https://web.mit.edu/~simsong/www/ugh.pdf Unix-Haters Handbook Preface Things Are Going to Get Lot Worse Before Things Get Worse “I liken starting one’s computing career with Unix, say as an undergraduate, to being born in East Africa. It is intolerably hot, your body is covered with lice and flies, you are malnourished and you suffer from numerous curable diseases. But, as far as young East Africans can tell, this is simply the natural condition and they live within it. By the time they find out differently, it is too late. They already think that the writing of shell scripts is a natural act.” -Ken Pier, Xerox PARC
      • dredmorbius 7y ago
        Whitelisting is safer than blacklisting. Mount /home noexec, mount ~/bin exec. If you're going to go this route. I don't go this far yet, but do strongly recommend nodev and nosuid except where absolutely needed. This is also a strong argument for multiple partitions rather than single-partition formatting.
        • fiddlerwoaroof 7y ago
          This is really interesting. I mount ~/Downloads anyways, because I put it on a nfs mount, but I’ve never considered some scheme like what you’re talking about. Maybe I’ll go for this on my next Linux machine. Also, there’s a better argument for not putting . in $PATH: if your $PATH is relatively static, you have less to think about when looking through your shell’s history for a particular command: if . is on the PATH, you always have to wonder whether a particular history entry is running a system-wide command or a command in $PWD