← Rules Catalog
mediumfilesystemverified rollback-safe

Mount /home with nosuid option

mount-home-nosuid · RHEL ≥ 8 · 1 impl

Description

The /home filesystem must be mounted with the nosuid option to prevent setuid and setgid files from being executed from user home directories.

Rationale

Allowing setuid/setgid execution from /home could allow a user to place a setuid binary in their home directory and escalate privileges. The nosuid mount option prevents this attack vector on user home directories.

Check → Remediate

Checkmount_option
mount_point:
/home
options:
nosuid
Remediatemount_option_set
mount_point:
/home
options:
nosuid

Framework references

CIS

rhel9 1.1.2.3.3rhel10 1.1.2.3.3rhel8 1.1.2.3.3

STIG

V-230299V-281089 / RHEL-10-400360V-257851 / RHEL-09-231050

NIST 800-53

CM-6AC-6

Live verification

rhel10:checkrhel8:checkrhel9:check
#mount#home#nosuid#security