Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

Is it possible to mount a single folder without the noexec option. I have a situation in which a web app in the users home folder on the server has to be mounted without noexec to run correctly, however, I don't want to remove the restriction for all users, just for that one.

The fstab looks like this:

# /dev/sda3       /home           ext3    defaults        0       2
UUID=cae3a489-22c1-43d8-aaf1-27306b32ebb0       /home           ext3    defaults,noexec        0       2

So, removing noexec from here would allow all the users to run executables, and I need a solution to allow it only for the user user.

share|improve this question

2 Answers

up vote 3 down vote

Do you mean you want to remove the noexec restriction on a directory in /home without removing it on the entire partition? If so, bind mounting the directory and remounting it with default options might work. But please conduct your own tests. Below is a dirty hack that seemed to work using EXT4, but it'd probably be cleaner/safer/better if you could bind mount the webapp directory somewhere besides on top of itself. This would have to run in a shell script, after mounts from fstab are complete:

mount --bind /home/user/webapp /home/user/webapp
mount /home/user/webapp -oremount,defaults
share|improve this answer
Yes, this is something I was looking for. I was hoping that there maybe exists a preferred way of doing it. Will wait a bit to see if a "server safer" solution pops up, if not will, mark you as the answer. – Alan Mar 15 at 13:07
Can you change the path that the app is installed at and or change the document root that the web server is looking for? For example, install the app at /home/user/webapp_src and then bind to /home/user/webapp and then remount and run it from there? A little cleaner that way. – depquid Mar 15 at 17:44
up vote 1 down vote

A web app shouldn't run from /home... and how does it need noexec to run correctly? If it doesn't need to run anything in there, it shouldn't try to do so, and the flag makes no difference at all in that case.

You could enforce the restrictions you want using e.g. SELinux labels, but that isn't easy. Or you could use ACLs and permissions on the files (see acl(7), setfacl(1)) to control who can execute the files. If access by "others" to any files in there isn't required at all, you can play with permissions of the directory.

share|improve this answer
I'm using a Django webap. There is a wsgi file in home/user/public_html, and the rest of the code is in /home/user/django because it doesn't need to be served directly. The numpy module, which the app uses, fails to work if in a directory mounted with noexec. – Alan Mar 15 at 12:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.