1

if i have /target mounted with suid and then make a bind-mount on /bound with mount -o bind,nosuid /target /bound, will nosuid take effect on /bound ?

(imo it should take effect but i'd still like a definite answer, and nobody else had asked yet here or so it seems)

4
  • What happens when you try it?
    – Jim L.
    Dec 12, 2019 at 0:24
  • @JimL. nosuid works when i try it, check the the answer below for details ^^
    – hanshenrik
    Dec 12, 2019 at 8:18
  • Did you mean /source? Jul 24, 2022 at 14:32
  • @ctrl-alt-delor yup that's a better name, feel free to edit the posts ^^
    – hanshenrik
    Jul 31, 2022 at 3:10

1 Answer 1

2

yes, bind is capable of enforcing nosuid even if the target has suid. here's a test i ran:

C source code of a.out:

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main(){
uid_t uid=getuid(), euid=geteuid();
printf("uid: %u, euid: %u\n",uid,euid);
return 0;
}

and then

root@ratma:/# mount -o bind,nosuid /target /bound
root@ratma:/# su hans
hans@ratma:/$ stat /target/a.out
  File: /target/a.out
  Size: 16712           Blocks: 40         IO Block: 4096   regular file
Device: 18h/24d Inode: 194454      Links: 1
Access: (6755/-rwsr-sr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2019-12-12 07:52:45.132465174 +0000
Modify: 2019-12-12 07:52:45.132465174 +0000
Change: 2019-12-12 07:53:24.720322010 +0000
 Birth: -
hans@ratma:/$ stat /bound/a.out
  File: /bound/a.out
  Size: 16712           Blocks: 40         IO Block: 4096   regular file
Device: 18h/24d Inode: 194454      Links: 1
Access: (6755/-rwsr-sr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2019-12-12 07:52:45.132465174 +0000
Modify: 2019-12-12 07:52:45.132465174 +0000
Change: 2019-12-12 07:53:24.720322010 +0000
 Birth: -
hans@ratma:/$ id
uid=1000(hans) gid=1000(hans) groups=1000(hans),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev)
hans@ratma:/$ /target/a.out
uid: 1000, euid: 0
hans@ratma:/$ /bound/a.out
uid: 1000, euid: 1000

success. if it didn't work, it would say "euid: 0" on /bound/a.out :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .