Why the need to mount a partition with nosuid when noexec is present?

10

2

I am using Fedora Core. I am to create a partition /data where users post some data (all have r+w permissions). Hence, for security purposes, I have to make it non-executable.

I understand from Linux security that noexec and nosuid must both be enabled for /data during mounting. I understand noexec and have it enabled. However I don't have nosuid enabled.

Any reason why both noexec and nosuid should be enabled for /data? Doesn't having just noexec suffice - since the users would not be able to run scripts and other programs, and nosuid does not matter?

zethra

Posted 2013-01-11T16:12:30.820

Reputation: 103

You would think so [that nosuid is redundant], yes. Can you cite any reference that recommended that you needed to enable nosuid even though noexec was already enabled? – Celada – 2013-01-11T18:19:08.180

Actually I have seen that everywhere. Even CIS benchmarks state nosuid to be a different check on /tmp partition. Other references are just by googling: http://www.techrepublic.com/blog/opensource/secure-temporary-files-in-linux/171

– zethra – 2013-01-11T18:43:50.270

1I have to guess that they're just being safe: so if you forget to set noexec at least you've still got nosuid. It's a weak argument though since both flags are configured in the same place, so if you forget one you're likely to forget the other one too! – Celada – 2013-01-11T18:49:56.947

Answers

2

According to the mount man page

noexec

Do not allow direct execution of any binaries on the mounted filesystem. (Until recently it was possible to run binaries anyway using a command like /lib/ld*.so /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)

So this looks like it's old advise from when noexec didn't stop all binaries from running, at least they weren't run with root privs.

peteches

Posted 2013-01-11T16:12:30.820

Reputation: 204

1If you ran the executable with that trick, would it have gotten set-uid permissions? – Barmar – 2017-06-08T14:58:31.983

Asked: 2013-01-11T16:12:30.820

Viewed: 2 579 times

Active: 2013-01-14T13:49:51.043