5 ms·

Rules like https://cisofy.com/lynis/controls/HRDN-7222/ https://cisofy.com/lynis/controls/HRDN-7222/ make me think the whole thing is snake oil. There is zero s

• perlgeek 2y ago
  Where does it say on that page that the hardening is not making them world-readable? > If a compiler is found, execution should be limited to authorized users only (e.g. root user).
  • viraptor 2y ago
    Unless you also mount some partitions noexec, making things not executable is useless. And if you have access to python/perl/ruby, you can construct any binary in memory anyway. And that's assuming someone's targeting some vulnerability chain which uses the compiler which is a stretch anyway.
• HeatrayEnjoyer 2y ago
  Preventing the compilation of code by arbitrary users is not harmful and reduces your attack surface.
• AbraKdabra 2y ago
  > There is zero security benefit I assume you don't work in security. The "HRDN" means it's a Hardening rule, and hardening is the action of reducing the attack surface for possible attacks as much as you can, even for the most crazy types, like a normal user or malware having access to download an exploit from exploit-db.com and being able to compile it without being root.