Skip to content
BOA Documentation

Powered by Grav

Strict binary permissions — `_STRICT_BIN_PERMISSIONS`

Strict binary permissions — _STRICT_BIN_PERMISSIONS

INI
# /root/.barracuda.cnf
_STRICT_BIN_PERMISSIONS=YES

Shipped default YES; recommended when you cannot fully restrict PHP functions via _PHP_FPM_DENY. Despite the name it drives two hardenings, and both run only during barracuda upgrade passes — any other run mode forces the setting off for that pass, so scripts you add or edit between upgrades stay untouched until the next upgrade run.

This knob backs protection #12 (restricted system binaries) on the security model page.

Group-read stripping

Strips group-read permissions from many system binaries that have group=root, so web shells cannot reach the most dangerous binaries directly (protection #12 on the security model page).

WARNING: Aggressive — it can break unmanaged binaries you have installed yourself. BOA only touches binaries with group=root and no setuid / setgid bits. Test in dev.

System-shell switch to dash

The same gate repoints the system shell: /bin/sh and /usr/bin/sh are symlinked to dash (falling back to bash where dash is absent — the dash and bash variants of the sweep are kept in lockstep), then /bin/sh references are rewritten to /bin/dash:

  • Explicitly: the shell fields in /etc/passwd, plus /etc/crontab, /etc/init.d/ssh, and the CSF /etc/csf/uninstall.sh and /etc/csf/remove_apf_bfd.sh scripts.
  • By scan: every non-setuid / non-setgid file in a fixed directory list that carries a #!/bin/sh-style (or #!/usr/bin/sh) shebang or a SHELL=/bin/sh line gets all its /bin/sh references rewritten — the shebang or SHELL= line is the trigger, the rewrite is file-wide. The list covers all the /etc/cron.* directories (cron.d, cron.daily, cron.hourly, cron.weekly, cron.monthly, cron.yearly), /etc/init.d, /lib/init, /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin and many other system script locations. cron.hourly, cron.yearly and /lib/init are recent additions to the scan list; the /etc/rc2.d–rc5.d symlink directories are no longer scanned.

Exemptions: setuid / setgid files are excluded from the scan, any file whose name ends in drush, clean-boa-env, dash, bash, ssh, sshd or websh is skipped wholesale, and /etc/init.d/clean-boa-env plus every websh install location carry explicit path guards in each rewrite test.

Operator takeaway: custom cron jobs dropped into /etc/cron.hourly, /etc/cron.yearly or any other scanned directory will have their /bin/sh shebangs and SHELL= lines rewritten to dash on the next barracuda upgrade while this hardening is on. Scripts relying on bashisms under a /bin/sh shebang will break — use an explicit #!/bin/bash shebang to stay untouched.

  • Security model — protection #12 (restricted system binaries) that this knob backs, and the broader trust model.
  • Security audit hardening — the filesystem permission baseline and codebase-wide audit outcomes.
  • FPM capacity sizing — the _PHP_FPM_DENY PHP-function restrictions this pairs with.

© 2026 BOA Documentation. All rights reserved.