Hacker News Reader

Comment by dijit | Hacker News Reader

that's not necessarily true as much as you think.

I worked in a Solaris shop that had gnu coreutils and packages installed everywhere with a <g> prefix, and another place running openbsd which had the same.

gecho, gcat, gln etc;

I'm pretty sure gnu coreutils can be built on any Unix-like OS.

View on HN

It depends on the IT guys, I have occasionally sshed into boxes where that wasn't the case and compiling wasn't an option.

- compile stuff statically on your own hw

- base64encode it

- paste the encoded text over ssh to a file

- base64decode it

- chmod +x the decoded file

- …

- profit

- Mount $HOME as noexec

- Disable execution bit for all directories for home

- If the UNIX variant allows it, jail/contain home for each user session

- Punish users or their employer if a consulting firm severely that bypass IT regulations

- If Linux, find the current local privilege escalation bug, get root, and burn it all to the ground.

Followed by get fired and charged.

Oh, you're no fun anymore!

> - Mount $HOME as noexec

/usr/bin/env $your_binary

> If the UNIX variant allows it, jail/contain home for each user session

does that still work? i know the /lib/ld-linux.so /some/binary doesn't work anymore

You also mentioned these points in your other comments here, but, to me, they look over the top to the point of being paranoic. That's probably because I lack any serious experience in admin side of things, nor of working in environments where such measures would be required.

So I wanted to ask: where such a level of security would be required? And also, what attacks does it defend from?

It should be "a lot of fun" to try to cross compile an AIX or Solaris binary on a Linux machine

You'll probably go insane doing it

(Linux x86 compiling to Linux ARM/PPC/etc is doable and done quite frequently)

Reply on news.ycombinator.com