Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 6 down vote favorite

I am using Fedora Core. I am to create a partition /data where users post some data (all have r+w permissions). Hence, for security purposes, I have to make it non-executable.

I understand from Linux security that noexec and nosuid must both be enabled for /data during mounting. I understand noexec and have it enabled. However I don't have nosuid enabled.

Any reason why both noexec and nosuid should be enabled for /data? Doesn't having just noexec suffice - since the users would not be able to run scripts and other programs, and nosuid does not matter?

share|improve this question
You would think so [that nosuid is redundant], yes. Can you cite any reference that recommended that you needed to enable nosuid even though noexec was already enabled? – Celada Jan 11 at 18:19
Actually I have seen that everywhere. Even CIS benchmarks state nosuid to be a different check on /tmp partition. Other references are just by googling: techrepublic.com/blog/opensource/… – zethra Jan 11 at 18:43
1  
I have to guess that they're just being safe: so if you forget to set noexec at least you've still got nosuid. It's a weak argument though since both flags are configured in the same place, so if you forget one you're likely to forget the other one too! – Celada Jan 11 at 18:49

1 Answer

up vote 1 down vote accepted

According to the mount man page

noexec

Do not allow direct execution of any binaries on the mounted filesystem. (Until recently it was possible to run binaries anyway using a command like /lib/ld*.so /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)

So this looks like it's old advise from when noexec didn't stop all binaries from running, at least they weren't run with root privs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.