Security Controls

HRDN-7222 - Permissions on installed compilers

Description

Compilers turn source code into binary executable code. For a production system a compiler is usually not needed, unless package upgrades are performed by means of their source code. If a compiler is found, execution should be limited to authorized users only (e.g. root user).

Group

Hardening

How to solve

Compilers are used for translating source code into machine language. This process happens usually during the development cycle, or by package maintainers. Although many systems have a compiler installed, it is often not used. That is an unnecessary risk.

Evildoers might abuse the presence of a compiler to make their malicious attacks work. Due to protections in the Linux kernel, memory allocation and execution of processes, is limited. To circumvent these protections, a compiler on the related system is needed, so the attacker can determine specific memory locations and leverage a so-called exploit.

Hardening options

When possible, removal of any unneeded compilers is the best option. This prevents users from compiling source code into binary programs. This is unusual for a production server, as most software comes precompiled. If you still need the compilers on your system, consider changing the file permissions or file ownership. This way only the root, or other privileged users, can use the compiler.

Additional resources


Linux and Unix System Hardening

This information is provided as part of the Lynis community project. It is related to Lynis control HRDN-7222. All information should be considered as-is, without guarantees. Any advice or snippets should be tested before implementing in production environments.

Lynis

Lynis is a technical security audit tool for systems running Linux, UNIX, *BSD, and macOS. It is open source software and free to use. The project has an active community, and can also be found on GitHub.

Lynis Enterprise

Need more advanced features, like vulnerability scanning, or reporting installed software packages? Lynis Enterprise will collect more data and present it with an easy to use web interface.

Gain additional benefits: automating security audits, reporting, and the implementation of related security measures.

Lynis Enterprise includes
  • Centralized management
  • Prioritized plans
  • Reporting
  • Dashboards
  • Integration (API)
  • Improvement snippets for tools like Ansible, Chef, Cfengine and Puppet

Take the Tour