Mount /var with nosuid option

Description

The /var filesystem must be mounted with the nosuid option to prevent setuid and setgid binaries from being executed from the variable data tree.

Rationale

/var holds variable data such as caches, spools, and logs that should never contain setuid/setgid executables. The nosuid mount option prevents an attacker who can write to /var from staging a setuid binary there to escalate privileges.

Framework references

Live verification