Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Fedora Core. I am to create a partition /data where users post some data (all have r+w permissions). Hence, for security purposes, I have to make it non-executable.

I understand from Linux security that noexec and nosuid must both be enabled for /data during mounting. I understand noexec and have it enabled. However I don't have nosuid enabled.

Any reason why both noexec and nosuid should be enabled for /data? Doesn't having just noexec suffice - since the users would not be able to run scripts and other programs, and nosuid does not matter?

share|improve this question
You would think so [that nosuid is redundant], yes. Can you cite any reference that recommended that you needed to enable nosuid even though noexec was already enabled? – Celada Jan 11 '13 at 18:19
Actually I have seen that everywhere. Even CIS benchmarks state nosuid to be a different check on /tmp partition. Other references are just by googling:… – zethra Jan 11 '13 at 18:43
I have to guess that they're just being safe: so if you forget to set noexec at least you've still got nosuid. It's a weak argument though since both flags are configured in the same place, so if you forget one you're likely to forget the other one too! – Celada Jan 11 '13 at 18:49
up vote 1 down vote accepted

According to the mount man page


Do not allow direct execution of any binaries on the mounted filesystem. (Until recently it was possible to run binaries anyway using a command like /lib/ld*.so /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)

So this looks like it's old advise from when noexec didn't stop all binaries from running, at least they weren't run with root privs.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .