mediumfilesystemverified ✓

Mount NFS filesystems with noexec option

mount-nfs-noexec · RHEL ≥ 8 · 1 impl

Description

NFS (Network File System) filesystems must be mounted with the noexec option to prevent code execution from network-mounted filesystems.

Rationale

Allowing code execution from NFS-mounted filesystems could allow an attacker who has write access to the NFS server to execute arbitrary code on client systems. The noexec mount option prevents this attack vector.

Check → Remediate

Checkcommand

grep -E '\snfs[0-9]?\s' /proc/mounts 2>/dev/null | grep -v 'noexec' | head -1

Remediatemanual

note:: Add noexec to the mount options for all NFS mount points in /etc/fstab. Remount existing NFS mounts with: mount -o remount,noexec <mountpoint>

Framework references

STIG

V-281229 / RHEL-10-700105V-257855 / RHEL-09-231070V-230306

NIST 800-53

CM-6SC-5

Live verification

rhel8:check

#mount#nfs#noexec#network#security