World/grp writable, SUID/SGID files to be set to root/wheel

[ermor]

Hello everyone,

I'm trying to implement as much of the Security Handbook (https://wiki.gentoo.org/wiki/Security_Handbook/File_permissions) as I can, and the section on file permissions say that I should change permissions of certain critical files to root (or presumably, wheel, since I'll have to deactivate the root user at the end).

However, I'm not sure which ones I should edit. I suspected doing it in a batch would be a bad idea, and other discussions seem to confirm it (https://forums.gentoo.org/viewtopic-t-189571-start-0.html and https://forums.gentoo.org/viewtopic-t-372360-start-0.html), but it's a bit vague which ones are concerned beyond "password files, configuration files and possibly other files that should only be used by root". Is there some sort of pattern that would allow me to guess which are only used by root, and which are also critical for normal users? I don't want to edit permissions for... say... crontab, only to be told that I needed to keep it world writable because regular users access it in the background or some such. Sorry if this is a dumb question, I'm not too used to digging into root files, generally speaking.

[NeddySeagoon]

ermor,

There is only one dumb question. That's the one you never ask. You run the risk of never knowing the answer.

Why are you following the Security Handbook?
What threats are you trying to defend against?

Do your threat analysis then deploy appropriate defences.

Keep in mind that security is like the layers of an onion. It's not to defeat determined well funded attackers. It's to make make life a difficult as possible far an attacker to do anything useful.
That leads to the security ease of use compromise. You will have to pick your balance point there. That's why the Security Handbook is a bit vague.

e.g. you can mount /tmp and /home noexec. Your users may hate you as they will not be able to install and run anything.
/tmp should already be noexec as its writeable by everyone.
You can add nodev and nosuid for good measure.

The first step in securing your system is your threat analysis.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[ermor]

[Hu]

I use noexec on /tmp and have not had any problems. I vaguely recall that certain third-party scripts for installing blobs from the Internet tend to break with this, but in my opinion, those scripts are almost always garbage anyway, so I consider breaking them to be a positive thing.

Yes, you can get noexec on a directory that is not a filesystem root, by way of a bind mount.

[NeddySeagoon]

ermor,

A long time ago /tmp was a a real on disk filesystem. For many years its been in tmpfs. That is, a piece of RAM, so that it starts off empty every boot.

[ermor]