mediumfilesystemverified ✓

Ensure nosuid option on NFS mounts

mount-nfs-nosuid · RHEL ≥ 8 · 1 impl

Description

The nosuid mount option must be set on all NFS mounts to prevent setuid programs from executing via NFS-mounted filesystems.

Rationale

NFS-mounted filesystems could contain setuid programs. The nosuid option prevents setuid bits from being honored on NFS mounts, preventing privilege escalation through remotely-mounted files.

Check → Remediate

Checkcommand

grep -E '\snfs[0-9]?\s' /proc/mounts 2>/dev/null | grep -v 'nosuid' | head -1

Remediatemanual

note:: Add the nosuid option to all NFS mount entries in /etc/fstab. Example: server:/share /mnt/nfs nfs defaults,nodev,nosuid 0 0

Framework references

STIG

V-281230 / RHEL-10-700110V-257856 / RHEL-09-231075V-230308

NIST 800-53

CM-6AC-6

Live verification

rhel8:check

#mount#nfs#nosuid#network#hardening