mediumfilesystemverified ✓

Mount removable media with nosuid option

mount-removable-nosuid · RHEL ≥ 8 · 1 impl

Description

Removable media filesystems must be mounted with the nosuid option to prevent setuid and setgid files from being executed from removable media.

Rationale

Allowing setuid/setgid execution from removable media could allow an attacker to introduce privileged binaries via portable storage devices. The nosuid mount option prevents privilege escalation attacks via removable media.

Check → Remediate

Checkcommand

bad=""
for mp in $(lsblk -o RM,MOUNTPOINT -n 2>/dev/null | awk '$1=="1" && $2!="" {print $2}'); do
  opts=$(findmnt "$mp" -o OPTIONS -n 2>/dev/null)
  case ",$opts," in *,nosuid,*) : ;; *) bad="$bad $mp" ;; esac
done
if [ -n "$bad" ]; then echo "FAIL: removable mounts missing nosuid:$bad"; exit 1; fi
echo "OK: no removable mount lacks nosuid"; exit 0

expected_exit:: 0

Remediatemanual

note:: Add nosuid to the mount options for removable media mount points in /etc/fstab or udev rules. For automounted removable media, configure the automounter to include nosuid in mount options.

Framework references

STIG

V-257859 / RHEL-09-231090V-230305

NIST 800-53

CM-6AC-19

Live verification

rhel8:check

#mount#removable#nosuid#security