Is it possible to mount a single folder without the noexec option. I have a situation in which a web app in the users home folder on the server has to be mounted without noexec to run correctly, however, I don't want to remove the restriction for all users, just for that one.

The fstab looks like this:

# /dev/sda3       /home           ext3    defaults        0       2
UUID=cae3a489-22c1-43d8-aaf1-27306b32ebb0       /home           ext3    defaults,noexec        0       2

So, removing noexec from here would allow all the users to run executables, and I need a solution to allow it only for the user user.


Do you mean you want to remove the noexec restriction on a directory in /home without removing it on the entire partition? If so, bind mounting the directory and remounting it with default options might work. But please conduct your own tests. Below is a dirty hack that seemed to work using EXT4, but it'd probably be cleaner/safer/better if you could bind mount the webapp directory somewhere besides on top of itself. This would have to run in a shell script, after mounts from fstab are complete:

mount --bind /home/user/webapp /home/user/webapp
mount /home/user/webapp -oremount,defaults
  • Yes, this is something I was looking for. I was hoping that there maybe exists a preferred way of doing it. Will wait a bit to see if a "server safer" solution pops up, if not will, mark you as the answer. – TheMeaningfulEngineer Mar 15 '13 at 13:07
  • Can you change the path that the app is installed at and or change the document root that the web server is looking for? For example, install the app at /home/user/webapp_src and then bind to /home/user/webapp and then remount and run it from there? A little cleaner that way. – depquid Mar 15 '13 at 17:44

A web app shouldn't run from /home... and how does it need noexec to run correctly? If it doesn't need to run anything in there, it shouldn't try to do so, and the flag makes no difference at all in that case.

You could enforce the restrictions you want using e.g. SELinux labels, but that isn't easy. Or you could use ACLs and permissions on the files (see acl(7), setfacl(1)) to control who can execute the files. If access by "others" to any files in there isn't required at all, you can play with permissions of the directory.

  • I'm using a Django webap. There is a wsgi file in home/user/public_html, and the rest of the code is in /home/user/django because it doesn't need to be served directly. The numpy module, which the app uses, fails to work if in a directory mounted with noexec. – TheMeaningfulEngineer Mar 15 '13 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.