Tmp security settings for logical volumes in CentOS

When Centos is installed without a specified partition by default, the logical volume does not have an independent/tmp, which may cause security risks./dev/shm is also one of the risks.

1. # Dd A 1 GB file, file/. tmpfs

2. Ddif =/dev/zeroof =/. tmpfsbs = 1 Mcount = 1000

4. # Create a file system

5. Mke2fs-j/. tmpfs

7. ####################

8. Mke2fs 1.41.12 (17-May-2010)

9. /. Tmpfsisnotablockspecialdevice.

10. Proceedanyway? (Y, n) y

11. Filesystemlabel =

12. OStype: Linux

13. Blocksize = 4096 (log = 2)

14. Fragmentsize = 4096 (log = 2)

15. Stride = 0 blocks, Stripewidth = 0 blocks

16. 64000 inodes, 256000 blocks

17. 12800 blocks (5.00%) reservedforthesuperuser

18. Firstdatablock = 0

19. Maximumfilesystemblocks = 264241152

20. 8 blockgroups

21. 32768 blockspergroup, 32768 fragmentspergroup

22. 8000 inodespergroup

23. Superblockbackupsstoredonblocks:

24. 32768,983 04, 163840,229 376

26. Writinginodetables: done

27. Creatingjournal (4096 blocks): done

28. Writingsuperblocksandfilesystemaccountinginformation: done

30. Thisfilesystemwillbeautomaticallycheckedevery32mountsor

31. 180 days, whichevercomesfirst. Usetune2fs-cor-itooverride.

32. ####################

34. # Copying files

35. Cp-av/tmp. old

37. # Mount the dd File

38. Mount-oloop, noexec, nosuid, rw/. tmpfs/tmp

40. # Assign the default/tmp permission

41. Chmod1777/tmp

43. # Move the copied file back

44. Mv-f/tmp. old/*/tmp/

46. # Deleting folders

47. Rm-rf/tmp. old

50. # Modify/etc/fstab to enable automatic mounting after it is restarted

51. /. Tmpfs/tmp ext3 loop, nosuid, noexec, rw 0 0

53. # Soft link/var/tmp to/tmp

54. Mv/var/tmp/var/tmp_bak

55. Ln-s/tmp/var/tmp

56. Cp-Rf/var/tmp_bak/*/var/tmp

57. Rm-rf/var/tmp_bak/

59. # Test

60. # Go To The/tmp and/dev/shm directories respectively, create executable files, and grant 777 Permissions

61. [Root @ localhost/tmp]

62. # Ls-lA/tmp/| grepx. sh

63. -Rwxrwxrwx1rootroot22Jul2515: 08x. sh

65. [Root @ localhost/tmp]

66. # Cat/tmp/x. sh

67. #! /Bin/bash

68. Echotest

70. [Root @ localhost/tmp]

71. #/Tmp/x. sh

72. -Bash:/tmp/x. sh: Permissiondenied

74. [Root @ localhost/dev/shm]

75. # Ls-lA | grep x. sh

76. -Rwxrwxrwx1rootroot22Jul2515: 08x. sh

78. [Root @ localhost/dev/shm]

79. # Cat x. sh

80. #! /Bin/bash

81. Echotest

83. [Root @ localhost/dev/shm]

84. #/Dev/shm/x. sh

85. -Bash:/dev/shm/x. sh: Permissiondenied

1. # Modify/etc/fstab to change the nosuid and noexec values of/dev/shm shared memory

2. Tmpfs/dev/shmtmpfsdefaults, nosuid, noexec, rw00

3. Mount-oremount/dev/shm/