|Securing and Optimizing Linux: RedHat Edition -A Hands on Guide|
|Prev||Chapter 5. General System Security||Next|
You can have more control on mounting a file system like /home and /tmp partitions with some nifty options like noexec, nodev, and nosuid. This can be setup in the /etc/fstab text file. The fstab file contains descriptive information about the various file systems mount options; each line addresses one file system. Details regarding to security options in the fstab text file are:
defaults: Allow everything quota, read-write, and suid on this partition.
noquota: Do not set users quotas on this partition.
nosuid: Do not set SUID/SGID access on this partition.
nodev: Do not set character or special devices access on this partition.
noexec: Do not set execution of any binaries on this partition.
quota: Allow users quotas on this partition.
ro: Allow read-only on this partition.
rw: Allow read-write on this partition.
suid: Allow SUID/SGID access on this partition.For more information on options that you can set in this file fstab, see the man pages about mount(8).
Edit the fstab file vi /etc/fstab and change it depending on your needs. For example:
/dev/sda11 /tmp ext2 defaults 1 2 /dev/sda6 /home ext2 defaults 1 2
/dev/sda11 /tmp ext2 defaults,rw,nosuid,nodev,noexec 1 2 /dev/sda6 /home ext2 defaults,rw,nosuid,nodev 1 2
|nosuid, Meaning do not allow set-user-identifier or set-group-identifier bits to take effect,|
|nodev, do not interpret character or block special devices on this file system partition,|
|noexec, do not allow execution of any binaries on the mounted file system.|
Once you have made the necessary adjustments to the /etc/fstab file, it is time to makethe Linux system aware about the modification. This can be accomplished with the following commands:
[root@deep] /#mount -oremount /home/ [root@deep] /#mount -oremount /tmp/
Each file system that has been modified must be remounted with the command show above. In our example we have modified the /home/, and /tmp/ file system and it is for this reason that we remount these file system with the above commands.