Hacker News Reader

Comment by pjmlp | Hacker News Reader

It depends on the IT guys, I have occasionally sshed into boxes where that wasn't the case and compiling wasn't an option.

View on HN

- compile stuff statically on your own hw

- base64encode it

- paste the encoded text over ssh to a file

- base64decode it

- chmod +x the decoded file

- …

- profit

- Mount $HOME as noexec

- Disable execution bit for all directories for home

- If the UNIX variant allows it, jail/contain home for each user session

- Punish users or their employer if a consulting firm severely that bypass IT regulations

- If Linux, find the current local privilege escalation bug, get root, and burn it all to the ground.

Followed by get fired and charged.

Oh, you're no fun anymore!

> - Mount $HOME as noexec

/usr/bin/env $your_binary

> If the UNIX variant allows it, jail/contain home for each user session

does that still work? i know the /lib/ld-linux.so /some/binary doesn't work anymore

You also mentioned these points in your other comments here, but, to me, they look over the top to the point of being paranoic. That's probably because I lack any serious experience in admin side of things, nor of working in environments where such measures would be required.

So I wanted to ask: where such a level of security would be required? And also, what attacks does it defend from?

It should be "a lot of fun" to try to cross compile an AIX or Solaris binary on a Linux machine

You'll probably go insane doing it

(Linux x86 compiling to Linux ARM/PPC/etc is doable and done quite frequently)

Reply on news.ycombinator.com