Lesson 3.28: Mount options: noexec, nosuid, nodev
Every file system is mounted with options, and three of them are cheap, effective hardening for places where anyone can write: noexec (programs on it can't be run directly), nosuid (setuid bits are ignored) and nodev (device files don't work). Attackers who get a foothold through a web application very often drop their tools into /tmp or /dev/shm and run them from there. In the lab you find such a drop on web02, see that /tmp and /dev/shm allow execution, make the options permanent in /etc/fstab, remount, and confirm what noexec does and doesn't stop.
16 min
You will learn to
- Read disks and mounts with lsblk and findmnt
- Explain noexec, nosuid and nodev
- Edit /etc/fstab and verify it
- Remount a file system with new options
- Know the limits of noexec
Key terms
- Mount
- Attaching a file system (a disk partition, tmpfs in RAM, a network share) at a directory.
- /etc/fstab
- The table of file systems mounted at boot: device, mount point, type, options, dump, pass.
- noexec
- Programs on this file system can't be executed directly.
- nosuid / nodev
- Setuid/setgid bits are ignored / device files are not interpreted.
- tmpfs
- A file system kept in RAM; /tmp, /run and /dev/shm often use it.
← The Linux filesystem hierarchy · All lessons · Rootless containers and user namespaces →