mediumfilesystemverified ✓rollback-safe
Mount /home with nosuid option
mount-home-nosuid · RHEL ≥ 8 · 1 impl
Description
The /home filesystem must be mounted with the nosuid option to prevent setuid and setgid files from being executed from user home directories.
Rationale
Allowing setuid/setgid execution from /home could allow a user to place a setuid binary in their home directory and escalate privileges. The nosuid mount option prevents this attack vector on user home directories.
Check → Remediate
Checkmount_option
- mount_point:
- /home
- options:
- nosuid
Remediatemount_option_set
- mount_point:
- /home
- options:
- nosuid
Framework references
CIS
rhel9 1.1.2.3.3rhel10 1.1.2.3.3rhel8 1.1.2.3.3
STIG
V-230299V-281089 / RHEL-10-400360V-257851 / RHEL-09-231050
NIST 800-53
CM-6AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#home#nosuid#security