Is anyone thinking about providing an install option for mounting /home (or individual directories under /home) and/or /root noexec? Fedora seems slanted more and more toward people that don't write code, have no real idea of security, etc. I'm OK with that, but IMHO, it's only a matter of time before dropping malicious executables into /home/$USER becomes a serious problem. Linux desktops don't have to achieve World Domination for this to become an issue. This needn't be a major inconvenience to coders, even if it was the default. The principle of least privilege should at least be considered--that's why it's considered a principle, instead of, say, a vague idea. Considerable damage can be done (from a privacy perspective, if nothing else) by grabbing user files--rooting the box isn't required. I, for one, don't like the idea of my address book escaping, and I would regard that as _minimal_ damage. If you're doing ssh, rsync, etc., via keys in /home/$USER/.ssh the possibility of escalating this into hugely damaging attacks on sensitive hosts exists. Let's not forget the common case of a home network sitting behind a broadband router, with a DMZ machine hosting sshd, httpd, etc., and another on a protected LAN doing desktop duty. I would consider that the minimal configuration to protect, not a single desktop machine with (possibly) multiple users under $HOME, if it can possibly be done without making things hopelessly complex for Aunt Ethel (mail, Web, plays music, and ?*) installing onto a single machine. What would the ROI be on doing this? The 'R' seems very large, particularly as many are switching to Linux for security reasons. Does anyone have a clear idea of what the 'I' would be? Factors to consider would include things an Aunt Ethel user might typically do, which would require /home/$USER to allow executables, not just installer changes. * Does anyone have any user surveys on what Aunt Ethel actually uses her machine for, or are we operating in a vacuum? I'd like to see some links, if anyone has any. I strongly doubt I'm a typical user. -- Fedora-security-list mailing list Fedora-security-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-security-list
