Vuln kernel tpe

Trusted Path Execution

This means that your kernel does not support Trusted Path Execution. ASL includes a special kernel that includes this capability.

TPE restricts users to only be able to run "trusted" applications in a "trusted" path. The kernel defines trusted applications as being owned by root, and only writable by the root user. This prevents an attacker from installing malicious software on the system as a non-root user. For example, TPE prevents a malicious user from running a bot or spam tool they have uploaded to the system, as the application would be owned by the user that uploaded it, and not root (this does not apply to web applications, as they are not applications, they are treated by the operating system as files and do not "execute", they are simply loaded by the web server which decides what to do with that data).

Another vulnerability this protects against is path abuse. Users, including root, can be tricked into running malicious software by modifying their path, or by taking advantage of their current path which may include directories where a malicious user could install software.

For example, if the directory /usr/local/bin were worth writable, and if that path came first in a users path, a malicious actor could place a copy of bash in that directory, thereby taking control of all that users shell sessions anytime they log in. A malicious actor could also replace software, even if they can not write to the file, if they can write to the directory by simply moving the file (they can not write to) and replacing it with another file.

This kernel protection prevents these well known and well understood attacks from occurring.

False Positives

There are no known False Positives for this.