What
Add shared memory hardening to the sysctl or misc module: mount /run/shm with noexec,nosuid to prevent code execution from shared memory.
Why
Attackers commonly use /dev/shm or /run/shm to stage and execute payloads because it's world-writable and often allows execution. Adding noexec,nosuid prevents this attack vector.
Suggested implementation
Add to /etc/fstab if not already present:
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0
Then remount: mount -o remount /run/shm
This is essentially a one-liner addition to an existing module. Add a verification check in mod_verify() that confirms noexec is in the mount options for /run/shm.
What
Add shared memory hardening to the
sysctlormiscmodule: mount/run/shmwithnoexec,nosuidto prevent code execution from shared memory.Why
Attackers commonly use
/dev/shmor/run/shmto stage and execute payloads because it's world-writable and often allows execution. Addingnoexec,nosuidprevents this attack vector.Suggested implementation
Add to
/etc/fstabif not already present:Then remount:
mount -o remount /run/shmThis is essentially a one-liner addition to an existing module. Add a verification check in
mod_verify()that confirmsnoexecis in the mount options for/run/shm.