6

Many guides on the internet recommend setting the nosuid and noexec options, for example on the /tmp mount point. But doesn't noexec imply nosuid? What cannot get executed cannot make use of the suid bit, right?

  • 4
    Does this answer your question? superuser.com/questions/532667/… It looks like 'nosuid' is basically recommended universally in case you might be using a kernel that allows noexec to be circumvented. – LJKims Jun 8 '17 at 14:41
  • 3
    The suid bit is not only useful for exec files. – Rui F Ribeiro Jun 8 '17 at 18:04
  • 2
    the setgid bit on directories seems to work fine even with nosuid. mount(2) says "MS_NOSUID: Do not honor set-user-ID and set-group-ID bits when executing programs from this filesystem." – ilkkachu Jun 8 '17 at 18:41
  • @RuiFRibeiro What else do you think it's useful for? – Gilles Jun 8 '17 at 23:06
2

Thanks for the link LJKims, it helps me to answer my own question. I forgot that the suid/sgid bit can also be set for directories.

According to the GNU coreutils documentation files and directories that are created in a suid-directory inherit the owner of the directory (sgid-directories inherit the group obviously). So, if you want to avoid this behaviour, setting both noexec and nosuid on a mount point makes sense.

For completeness: in my tests on a current Debian, the suid bit on directories takes no effect, but only the sgid bit makes files/directories inherit the group of the directory.

# mkdir /test
# chmod 6777 /test
# ls -ld /test
drwsrwsrwx 2 root root 4096 Jun 10 18:50 /test
$ mkdir /test/foo; touch /test/bar
$ ls -l /test
-rw-r--r-- 1 user root    0 Jun 10 18:51 bar
drwxr-sr-x 2 user root 4096 Jun 10 18:51 foo

Edit: For completeness: The nosuid mount option does not affect sgid-directories (on Debian 8 at least).

# mount -o loop,nosuid test.img /test
# mkdir /test/foo
# chmod 2777 /test/foo
$ touch /test/foo/bar; mkdir /test/foo/baz
$ ls -l /test/foo
-rw-r--r-- 1 user root    0 Jun 12 09:46 bar
drwxr-sr-x 2 user root 4096 Jun 12 09:46 baz
  • 1
    But AFAICT the nosuid option has no effect on the sgid behaviour of directories (the files created in sgid directories still inherit the group of the directory). – Stéphane Chazelas Jun 10 '17 at 19:45
  • That's right, see my edit. Thanks for the remark. – kunfoo Jun 12 '17 at 7:56
  • But then that doesn't explain why combining nosuid with noexec makes any difference. – Stéphane Chazelas Jun 12 '17 at 9:48
  • Well, if the distribution pays respect to the suid bit on directories, then it makes a difference. – kunfoo Jun 14 '17 at 13:04
  • I don't understand what you mean. the nosuid flag makes no different wrt the behaviour of the suid/sgid bits on directories. So far, we've only ascertained that it has an effect on the execve() system call, but with noexec, execve() will refuse to execute the files anyway regardless of the permission bits. – Stéphane Chazelas Jun 14 '17 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.