Re: Re[2]: Linux hardening

On Aug 23, 2005, at 12:58 PM, Kir wrote:

>> How did u modify your wget or curl for not to download to /tmp  
>> and /var/tmp?
>>
>
> It`s  simple, really: you can modify source code of the wget
> to   include  string  matching (strncmp(url, "/tmp", 4)) and
> throwing  exception on positive result. Then all you need to
> do  is recompile code and replace original wget with the new
> one.
>

What do you mean? Curl prints to STDOUT. If someone manages to exec a  
shell, couldn't he just redirect the curl output to /tmp as he desires?

Anyway, it seems to me it'd be more effective to make sure he cannot  
execute whatever it is he downloaded; the noexec flag and GRSec's TPE  
would probably both be useful for that.

Or did I misunderstand you?

Dan