CME-503

nosuid on Non-Root Partitions

Harden OS/Kernel Unquantified evidence Preventive

Description

Mounts partitions like /tmp, /var, /home with nosuid, preventing SUID/SGID binaries from taking effect, blocking a privilege escalation vector.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Cannot deploy SUID binaries to escalate privileges from these partitions

CWE Relationships

CWE-269

Verification

Check nosuid on non-root partitions

$ mount | grep '/tmp' | grep nosuid
# Expected: nosuid

Platform: linux

$ mount | grep '/home' | grep nosuid
# Expected: nosuid

Platform: linux

Remediation

linux Mount /home, /var, and /tmp with nosuid to block SUID privilege escalation


mount -o remount,nosuid /home
mount -o remount,nosuid /var
mount -o remount,nosuid /tmp
grep -q '[[:space:]]/home[[:space:]]' /etc/fstab && sed -i '/[[:space:]]/home[[:space:]]/ s/defaults/defaults,nosuid/' /etc/fstab || echo '# CME-503: nosuid on /home — add nosuid to existing /home mount entry manually'
grep -q '[[:space:]]/var[[:space:]]' /etc/fstab && sed -i '/[[:space:]]/var[[:space:]]/ s/defaults/defaults,nosuid/' /etc/fstab || echo '# CME-503: nosuid on /var — add nosuid to existing /var mount entry manually'
grep -q '[[:space:]]/tmp[[:space:]]' /etc/fstab && sed -i '/[[:space:]]/tmp[[:space:]]/ s/defaults/defaults,nosuid/' /etc/fstab || echo 'tmpfs /tmp tmpfs defaults,nosuid 0 0' >> /etc/fstab