Lynis Security Controls
HRDN-7222 - Permissions on installed compilers
Compilers turn source code into binary executable code. For a production system a compiler is usually not needed, unless package upgrades are performed by means of their source code. If a compiler is found, execution should be limited to authorized users only (e.g. root user).
How to solve
Compilers are used for translating source code into machine language. This process happens usually during the development cycle, or by package maintainers. Although many systems have a compiler installed, it is often not used. That is an unnecessary risk.
Evildoers might abuse the presence of a compiler to make their malicious attacks work. Due to protections in the Linux kernel, memory allocation and execution of processes, is limited. To circumvent these protections, a compiler on the related system is needed, so the attacker can determine specific memory locations and leverage a so-called exploit.
When possible, removal of any unneeded compilers is the best option. This prevents users from compiling source code into binary programs. This is unusual for a production server, as most software comes precompiled. If you still need the compilers on your system, consider changing the file permissions or file ownership. This way only the root, or other privileged users, can use the compiler.
- Audit installed compilers and their packages (Insights on how to check what compilers are installed.)
- Understanding Linux Privilege Escalation (Understanding the how software is abused to gain a high level of privileges.)
Perform daily health checks of your environment, learn in-depth system hardening, and protect your systems better.Upgrade to Lynis Enterprise
Linux and Unix System Hardening
This information is provided as part of the Lynis community project. It is related to Lynis control HRDN-7222. All information should be considered as-is, without guarantees. Any advice or snippets should be tested before implementing in production environments.
Lynis is a technical security audit tool for Unix flavors like Linux, macOS, AIX, Solaris, and *BSD. It is open source software and free to use. The project has an active community, including open development via GitHub.
Need more advanced features, like vulnerability scanning, or reporting installed software packages? Lynis Enterprise will collect more data and present it with an easy to use web interface.
Gain additional benefits: automating security audits, reporting, and the implementation of related security measures.
- Centralized management
- Prioritized plans
- Integration (API)
- Improvement snippets for tools like Ansible, Chef, Cfengine, Puppet, and SaltStack