Strict binary permissions

# /root/.barracuda.cnf
_STRICT_BIN_PERMISSIONS=YES

Shipped default YES; recommended when you cannot fully restrict PHP functions via _PHP_FPM_DENY. Despite the name it drives two hardenings, and both run only during barracuda upgrade passes — any other run mode forces the setting off for that pass, so scripts you add or edit between upgrades stay untouched until the next upgrade run.

This knob backs protection #12 (restricted system binaries) on the security model page.

Group-read stripping

Strips group-read permissions from many system binaries that have group=root, so web shells cannot reach the most dangerous binaries directly (protection #12 on the security model page).

WARNING: Aggressive — it can break unmanaged binaries you have installed yourself. BOA only touches binaries with group=root and no setuid / setgid bits. Test in dev.

System-shell switch to dash

The same gate repoints the system shell: /bin/sh and /usr/bin/sh are symlinked to dash (falling back to bash where dash is absent — the dash and bash variants of the sweep are kept in lockstep), then /bin/sh references are rewritten to /bin/dash:

• Explicitly: the shell fields in /etc/passwd, plus /etc/crontab, /etc/init.d/ssh, and the CSF /etc/csf/uninstall.sh and /etc/csf/remove_apf_bfd.sh scripts.
• By scan: every non-setuid / non-setgid file in a fixed directory list that carries a #!/bin/sh-style (or #!/usr/bin/sh) shebang or a SHELL=/bin/sh line gets all its /bin/sh references rewritten — the shebang or SHELL= line is the trigger, the rewrite is file-wide. The list covers all the /etc/cron.* directories (cron.d, cron.daily, cron.hourly, cron.weekly, cron.monthly, cron.yearly), /etc/init.d, /lib/init, /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin and many other system script locations. cron.hourly, cron.yearly and /lib/init are recent additions to the scan list; the /etc/rc2.d–rc5.d symlink directories are no longer scanned.

Exemptions: setuid / setgid files are excluded from the scan, any file whose name ends in drush, clean-boa-env, dash, bash, ssh, sshd or websh is skipped wholesale, and /etc/init.d/clean-boa-env plus every websh install location carry explicit path guards in each rewrite test.

Operator takeaway: custom cron jobs dropped into /etc/cron.hourly, /etc/cron.yearly or any other scanned directory will have their /bin/sh shebangs and SHELL= lines rewritten to dash on the next barracuda upgrade while this hardening is on. Scripts relying on bashisms under a /bin/sh shebang will break — use an explicit #!/bin/bash shebang to stay untouched.

websh comes back at the end of the pass

On a hosted box /bin/sh is normally BOA's dispatcher websh — the ltd worker and the five-minute agent pass both enforce that symlink. A barracuda upgrade pass repoints it to dash as described above, and every octopus run starts by doing the same, because the installers run scripts in user areas that websh refuses. The barracuda and octopus launcher wrappers put websh back as the last thing they do, whether the run completed or aborted (_symlink_to_websh, the ltd worker's own block: a websh that carries its _forward_to_dash sentinel, never while an install marker is held), so a shell account never waits for the next worker or agent tick to get the per-account PHP-CLI pin and websh's Drush option refusals back. A chained boa in-<tree> install runs the launchers without the wrappers and keeps dash for its whole chain, as before; the worker and the agent pass keep enforcing the symlink on every tick, and the wrapper tail only closes the gap between a pass and the next tick. The same strict block refreshes the websh file itself from the build tree; because that file is /bin/sh, the copy is staged beside it and renamed into place, so a pass interrupted mid-copy can never leave a truncated dispatcher on the live path.

Related

• Security model — protection #12 (restricted system binaries) that this knob backs, and the broader trust model.
• Security audit hardening — the filesystem permission baseline and codebase-wide audit outcomes.
• FPM capacity sizing — the _PHP_FPM_DENY PHP-function restrictions this pairs with.