When securing a Linux web server, administrators obsess over configuring firewalls and disabling SSH root logins. However, one of the most frequently exploited vulnerabilities in local privilege escalation attacks is actually a small, temporary filesystem managed by the kernel: Shared Memory (/run/shm or /dev/shm).
Shared memory is designed to allow running programs to pass data directly between one another at RAM speeds, completely bypassing the slow mechanical hard drive. To facilitate this, the /run/shm directory is universally world-writable. Any user, regardless of their privilege level, can write files to it.
Hackers abuse this by downloading malicious scripts directly into the shared memory directory and executing them from RAM. Because the files never touch the physical hard drive, they frequently bypass standard antivirus scans and file integrity monitors. To secure your server, you must mount the shared memory directory with strict execution restrictions.
Step 1: Check Current Mount Options
First, let’s see how exposed your server currently is.
- Log into your server via SSH.
- Type the following command to view the current mount parameters for shared memory:
mount | grep shm - Press Enter.
You will likely see an output resembling: tmpfs on /run/shm type tmpfs (rw,nosuid,nodev). If the word noexec is missing from those parentheses, your shared memory is actively capable of executing binary scripts, making your server highly vulnerable.
Step 2: Edit the fstab File
To lock down this directory, we must instruct the kernel to mount it with the noexec (no execution) flag. This ensures that even if a hacker successfully downloads a malicious script into the directory, the Linux kernel will absolutely refuse to run it.
- Open the filesystem table configuration file using a root text editor:
sudo nano /etc/fstab - Scroll to the very bottom of the file. Do not edit any existing lines.
- Paste the following configuration on a brand new line at the bottom:
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0 - Save the file and exit (Ctrl+O, Enter, Ctrl+X).
(Note: Some older distributions use /dev/shm instead of /run/shm. Verify your exact path using the command in Step 1 and adjust the fstab file accordingly).
Step 3: Apply the Changes Instantly
You do not need to reboot your production server to apply this security patch. You can instruct the kernel to instantly remount the directory using the new rules you just wrote.
- Type the following command:
sudo mount -o remount /run/shm - Press Enter.
Run the mount | grep shm command one final time. The output should now clearly display (rw,nosuid,noexec). Your shared memory is now completely neutered against script execution, slamming shut one of the most common vectors for privilege escalation.