mount filesystems with nosuid

[Nappy_1]

We have recieved a System health check report from HP. One of the recommendations in the reports is mounting all filesystems with nosuid option.
since we are running Oracle DB and a Billing appilication from LHS, is there some filesystems that should not be mounted with nosuid option?

[HP-UX_Ali · Accepted solution]

hello Nappy,

For remounting filesystem with nosuid, you can use below command.

mount -o remount,nosuid,rw, /

It depends upon you to decide whether to mount other filesystem with nosuid, as per your environment. HP will provide standard recommendation which needs to be applied.

Mounting the filesystem with "nosuid" keeps everyone to run SUID programs i.e. to start a program not under the UID of the starter but the owner of the file.

By example, if you mounted '/usr' as a 'nosuid' filesystem, then whenever a noraml users user attempted to change his/her password, they would be denied. This is because it is the 'setuid' bit and the 'root' ownership of the 'passwd' executable that confer an effective UID of 'root' to the normal user when (s)he runs the 'passwd' command


Thanks & Regards
Ali

[Jose Mosquera]

Hi,

A mount option is a flag that controls how the filesystem may be accessed. In this case "nosuid" option disallow the "SUID bit" over a mount point.

Rgds.

[Jose Mosquera]

Ooops...

For datiled info about mount options:
#man mount_vxfs

Rgds.