2

I have mounted several data drives and used noexec parameter. Thinking that since it's only data I wouldn't need exec. Now I am having some permission issues and would like to rule this out as the cause as well as to understand the option better.

Does exec parameter in /etc/fstab have the same effect as giving execute permissions to all directories and files in the mounted system?

How does it affect windows executables (.exe) accessed via samba shares or other network protocols?

Mounted drives will be pooled with aufs or mhddfs and accessed via a central mount point in /mnt/virtual. It will then be accessed via network (samba right now). There will be some local access too (xbmc). I am not sure if I should provide it a direct link or samba link to the files?

What is the best practice in this case?

1

Looking through the man pages

If you look at the man page for mount.cifs which is what will be used to mount any shares listed in /etc/fstab there is a note that mentions noexec.

excerpt - mount.cifs man page

This command may be used only by root, unless installed setuid, in which case the noeexec and nosuid mount flags are enabled. When installed as a setuid program, the program follows the conventions set forth by the mount program for user mounts, with the added restriction that users must be able to chdir() into the mountpoint prior to the mount in order to be able to mount onto it.

Some samba client tools like smbclient(8) honour client-side configuration parameters present in smb.conf. Unlike those client tools, mount.cifs ignores smb.conf completely.

Given this I would expect it to honor the exec/noexec option if it's included in any mount attempts. Additionally looking at the mount.cifs usage shows how that option would be used.

excerpt - mount.cifs usage
Less commonly used options:
    credentials=<filename>,guest,perm,noperm,setuids,nosetuids,rw,ro,
    sep=<char>,iocharset=<codepage>,suid,nosuid,exec,noexec,serverino,
    mapchars,nomapchars,nolock,servernetbiosname=<SRV_RFC1001NAME>
    directio,nounix,cifsacl,sec=<authentication mechanism>,sign,fsc

Looking at the fstab man page explains the intended purpose for exec/noexec, but doesn't specify whether it's for all executables or just Unix ones.

excerpt from fstab man page

exec / noexec

exec lets you execute binaries that are on that partition, whereas noexec does not let you do that. noexec might be useful for a partition that contains no binaries, like /var, or contains binaries you do not want to execute on your system, or that cannot even be executed on your system, as might be the case of a Windows partition.

Does exec/noexec make everything executable?

No the exec/noexec attribute simply gates the allowing of things that are marked as executable through their permissions bits, it doesn't effect the permissions directly.

What about Window's binaries?

However, the setting of exec/noexec has no control over Windows executables, only Unix executables that can also reside on these shares.

Also I'm not even sure how these would come into play if you're mounting a CIFS/Samba share through /etc/fstab, when would a Windows OS even come into the mix in this scenario. Windows would/could mount this share itself directly and not even bother going through Linux.

Testing it out

Example from Unix

You can test this out using mount.cifs directly via the command line like so. Assuming we had a file on the CIFS/Samba share as follows:

$ cat cmd.bash 
#!/bin/bash

echo "hi"

$ chmod +x cmd.bash

Now we mount it like so, and try and run out script, cmd.bash:

$ mount.cifs //server/cifsshare /path/to/cifsmnt -o user=joeuser,noexec

$ cd /path/to/cifsmnt
$ ./cmd.bash
bash: ./cmd.bash: Permission denied

If we omit that option, noexec:

$ mount.cifs //server/cifsshare /path/to/cifsmnt -o user=joeuser

$ cd /path/to/cifsmnt
$ ./cmd.bash
hi
From Windows

The only scenario I could conceive of here would be if I was using something like Virtualbox and I mounted a CIFS/Samba share inside of a directory that a Windows VM could then utilize.

When I tested this out, I was successfully able to run .exe files through this mounting setup.

NOTE: I used the \\vboxsrv share mechanism in Virtualbox to mount my home directory that's local on my system, /home/saml. I then ran this command, mounting a CIFS/Samba share as a directory inside /home/saml.

$ mkdir /home/saml/cifsmnt
$ mount //server/cifsshare cifsmount -o user=joeuser,noexec

Conclusions

Doing the above would seem to indicate that exec/noexec has no baring over Windows' access to the files.

  • Are .exe files on windows considered binaries in this scenario? When I tried to run .exe on windows via samba share I was asked to log in again. Will this change if I add exec parameter? Also is it equivalent to giving execute permissions to the partition recursively? – DominicM Oct 14 '14 at 11:34
  • @DominicM - no it doesn't control Window's .exe files. – slm Oct 14 '14 at 12:14
  • Thanks for adding more to your answer, though I dont know why you think I mount an existing samba share in fstab. I am only mounting drives/partitions in fstab, then I mount aufs/mhddfs in rc.local and finally share directories within the resulting pool via samba. – DominicM Oct 14 '14 at 15:07
  • @DominicM - you stated Samba shares in your Q, so that's what Samba shares are. Otherwise you meant NTFS/FAT32 partitions. Also I was trying to demonstrate to you the effects of exec/noexec wrt Samba shares and how it has no effect. – slm Oct 14 '14 at 15:09
  • I guess you could see it that way, though I meant how the share of the partitions is affected :) Also, could you answer the first question as I am still not entirely sure if exec simply applies execute permissions to all contents or it's different in some way. – DominicM Oct 14 '14 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.