Mount options for security - nodev, nosuid, noexec

Filesystem mount options defend against a class of attacks that exploit user-writable filesystems. This lesson covers the security-relevant options and where to apply them.

The three primary options

Combined, they prevent:

• A user creating a device file (mknod /tmp/disk b 8 0) and reading raw disks.
• A user uploading a setuid binary and getting a root shell.
• A user uploading an executable and running it.

Where to apply

User-writable filesystems benefit most:

# /etc/fstab
tmpfs   /tmp         tmpfs   defaults,nodev,nosuid,noexec,size=1G   0 0
tmpfs   /dev/shm     tmpfs   defaults,nodev,nosuid,noexec,size=1G   0 0
/dev/sda1 /var        ext4    defaults,nodev                    0 2

/tmp and /dev/shm are the highest-priority targets. They are world-writable and frequently used by attackers.

/var can usually have nodev. nosuid and noexec may break some applications.

When not to apply

noexec breaks:

• Compilers in /tmp (rare in production).
• Any application that uses /tmp for executable code.

nosuid breaks:

• sudo if it relies on a setuid binary in /tmp (rare; sudo’s binary is in /usr/bin).
• Applications that expect setuid binaries on the filesystem.

nodev is safe almost everywhere except /dev itself.

Verify

mount | grep -E '/tmp|/dev/shm'
findmnt /tmp /dev/shm
cat /proc/self/mountinfo | grep -E '/tmp|/dev/shm'

Each should show the security options applied.

Test before persisting

A wrong mount option can break the boot:

# Test with a temporary mount
sudo mount -o remount,nodev,nosuid /tmp

# Verify applications still work

If the test passes, edit /etc/fstab:

UUID=... /tmp ext4 defaults,nodev,nosuid,noexec 0 2

Other useful options

Application compatibility

Common cases where noexec breaks things:

• Compiled languages: gcc, javac, etc. - usually not in /tmp.
• Container runtimes: container processes may run from /var/lib/docker.
• Web applications: PHP and other CGI processes may store cached bytecode in /tmp.
• Some installers: install scripts may extract and run from /tmp.

Audit before applying noexec:

# What runs from /tmp?
sudo lsof +D /tmp 2>/dev/null | grep -i exec

If applications use /tmp for execution, either move them to /var/tmp (which is not noexec) or remove noexec.

Knowledge check