You can have more control on mounting a file system like /home
and /tmp
partitions with some nifty options like noexec, nodev, and nosuid. This can be
setup in the /etc/fstab
text file. The fstab file contains descriptive information about the various file systems mount options; each line addresses one file system.
Details regarding to security options in the fstab text file are:
For more information on options that you can set in this file fstab, see the man pages about mount(8).
Edit the fstab file vi /etc/fstab
and change it depending on your needs. For example:
/dev/sda11 /tmp ext2 defaults 1 2 /dev/sda6 /home ext2 defaults 1 2
To read:
/dev/sda11 /tmp ext2 defaults,rw,nosuid,nodev,noexec 1 2 /dev/sda6 /home ext2 defaults,rw,nosuid,nodev 1 2
nosuid , Meaning do not allow set-user-identifier or set-group-identifier bits to take effect,
|
nodev , do not interpret character or block special devices on this file system partition,
|
noexec , do not allow execution of any binaries on the mounted file system.
|
Take a note that we have added the rw
option to the modified lines above. This is because the default options for these lines are defaults, which means to set quota, read-write, and suid, so we must
add the rw
option to continue having read-write access on these modified file systems.
For our example above, the /dev/sda11
represent our /tmp
directory partition on the system, and /dev/sda6
the /home
directory partition. Of course this will be not the same for you, depending on how you have partitioned your hard disk and what kind of disks are installed on your system, IDE -hda, hdb, etc
or SCSI -sda
, sdb
, etc.
Once you have made the necessary adjustments to the /etc/fstab
file, it is time to makethe Linux system aware about the modification. This can be accomplished with the following commands:
[root@deep] /#mount -oremount /home/ [root@deep] /#mount -oremount /tmp/
Each file system that has been modified must be remounted with the command show above. In our example we have modified the /home/
,
and /tmp/
file system and it is for this reason that we remount these file system with the above commands.