There is a host with a local service that receives data from a remote location (via e.g. http) and saves it locally under /var/log/data/ in some mydir.$ ls -al /var/log/data  drwxr-sr-x+ 4 root datalog                4096 Feb  4 18:59 .  drwxr-xr-x  4 root root                   4096 Feb  4 18:59 ..  drwxr-sr-x+ 2 root service                4096 Feb  4 19:07 mydir  The local service is run with service:service ownership.Let's assume that I want to prevent execution of an exploit program that wouldbe found in /var/log/data/mydir:  -rwxr-sr-x 1 root service 133156 Jul 19  2014 exploit  Note the s (setgid) bit on exploit file, which makes it execute with service group rights (the same as the local service).How can I prevent potential exploit from being executed there ?Removing x (go-x) from /var/log/data/ and /var/log/data/mydir ? It would probably disrupt service's work ... ?Any other idea ?
how to set up permissions of download dir to prevent execution of exploit program
linux;files;permissions;security