Control mounting a file system

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 5. General System Security | Next

# 5.16. Control mounting a file system

You can have more control on mounting a file system like `/home` and `/tmp` partitions with some nifty options like noexec, nodev, and nosuid. This can be setup in the `/etc/fstab` text file. The fstab file contains descriptive information about the various file systems mount options; each line addresses one file system. Details regarding to security options in the fstab text file are:

defaults: Allow everything quota, read-write, and suid on this partition.

noquota: Do not set users quotas on this partition.

nosuid: Do not set SUID/SGID access on this partition.

nodev: Do not set character or special devices access on this partition.

noexec: Do not set execution of any binaries on this partition.

quota: Allow users quotas on this partition.

ro: Allow read-only on this partition.

rw: Allow read-write on this partition.

suid: Allow SUID/SGID access on this partition.

For more information on options that you can set in this file fstab, see the man pages about mount(8).

Edit the fstab file vi `/etc/fstab` and change it depending on your needs. For example:

                 /dev/sda11	        /tmp		ext2	defaults        1 2
                 /dev/sda6		/home		ext2	defaults        1 2

To read:

                 /dev/sda11 	/tmp 		ext2 	defaults,rw,nosuid,nodev,noexec	1 2
                 /dev/sda6 	        /home 		ext2 	defaults,rw,nosuid,nodev	1 2

`nosuid`, Meaning do not allow set-user-identifier or set-group-identifier bits to take effect,
`nodev`, do not interpret character or block special devices on this file system partition,
`noexec`, do not allow execution of any binaries on the mounted file system.

Take a note that we have added the `rw` option to the modified lines above. This is because the default options for these lines are defaults, which means to set quota, read-write, and suid, so we must add the `rw` option to continue having read-write access on these modified file systems. For our example above, the `/dev/sda11` represent our `/tmp` directory partition on the system, and `/dev/sda6` the `/home` directory partition. Of course this will be not the same for you, depending on how you have partitioned your hard disk and what kind of disks are installed on your system, IDE -hda, hdb, etc or SCSI -`sda`, `sdb`, etc.

Once you have made the necessary adjustments to the `/etc/fstab` file, it is time to makethe Linux system aware about the modification. This can be accomplished with the following commands:

                 [root@deep] /#mount -oremount /home/
                 [root@deep] /#mount -oremount /tmp/

Each file system that has been modified must be remounted with the command show above. In our example we have modified the `/home/`, and `/tmp/` file system and it is for this reason that we remount these file system with the above commands.

Prev | Home | Next
Put limits on resource | Up | Conceal binary RPM