\section{Filesystem Security}
\begin{frame}
   {Using Secure Mounting Options}

   \begin{itemize}
      \item
      \texttt{nodev}

      Do not interpret character or block special
      devices on the filesystem
      \item
      \texttt{nosuid}

      The \textbf{set-user-identifier} or
      \textbf{set-group-identifier} bits are not to take
      effect

      \item
      \texttt{noexec}

      Restrict direct execution of any binaries on the
      mounted filesystem
      \item
      \texttt{ro}

      Mount the filesystem in \textbf{read-only} mode
   \end{itemize}

\end{frame}

\cprotect\note{

   When a filesystem is mounted, either at the command
   line with a \textbf{mount} command, or automatically by
   inclusion in \filelink{/etc/fstab}, various options can
   be specified to enhance security

   For example, the \texttt{ro} option is used to mount
   the filesystem in read-only mode.
   \begin{cmd}
$ mount -o ro,noexec,nodev /dev/sda2 /edsel
   \end{cmd}
   In \filelink{/etc/fstab}
   \begin{cmd}
/dev/sda2 /edsel ext4 ro,noexec,nodev 0 0
   \end{cmd}
}

\section{setuid/setgid bits}
\begin{frame}
   {setuid/setgid bits}

   \begin{itemize}
      \item For executable files
      \begin{itemize}
         \item Process run by user have privileges of
         owner or group
         \begin{cmd}
$ chmod u+s somefile
$ chmod g+s somefile
         \end{cmd}
      \end{itemize}
      \item For directories
      \begin{itemize}
         \item Used to create a shared directory
         \item Files created in \textbf{sgid} directory are
         group owned by the group owner of directory
         \begin{cmd}
$ chmod g+s somedir
         \end{cmd}
      \end{itemize}
      \item
      Changing the \textbf{setuid} bit on a script has no effect.
      \begin{itemize}
         \item
         You would have to change it on \textbf{bash} itself,
         a very bad idea!
      \end{itemize}

   \end{itemize}

\end{frame}

\cprotect\note{

   Normally, programs are  run with the privileges of the
   user who is executing the program. This means no matter
   who actually owns the binary executable that is
   running, the process still has constricted privileges.

   Occasionally it may make sense to have normal users
   have expanded capabilities they would not normally
   have, such as the ability to start or stop a network
   interface, or edit a file owned by the superuser.

   By setting the \textbf{setuid} (\textbf{s}et
   \textbf{u}ser \textbf{ID}) flag on an executable file,
   one modifies this normal behavior by giving the program
   the access rights of the \textbf{owner} rather than the
   \textbf{user} of the program.

   Furthermore, one can also set the \textbf{setgid} bit
   so the process runs with the privileges of the group
   that owns the file rather than those of the one running
   it.

   We should emphasize that this is generally a
   \textbf{bad idea} and is to be avoided in most
   circumstances. It is often better to write a
   \textbf{daemon} program with lesser privileges for this
   kind of use.  Some \textbf{Linux} distributions have actually
   disabled this ability entirely.

   By default, when a file is created in a directory it is
   owned by the user and group of the user that created
   it.  Using the \textbf{setgid} setting on the directory
   changes this so that files created in the directory are
   group owned by the group owner of the directory.  This
   allows you to create a shared directory in which a
   group of users can share files.  }



