LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-17-2017, 06:30 AM   #1
apj
LQ Newbie
 
Registered: Apr 2014
Location: India
Distribution: ubuntu , CentOS , Redhat , AIX
Posts: 17

Rep: Reputation: Disabled
/tmp partition mount with noexec


How to mount /tmp with noexec because there is no entry is /etc/fstab in centos 7?
 
Old 12-17-2017, 06:53 AM   #2
MadeInGermany
Senior Member
 
Registered: Dec 2011
Location: Simplicity
Posts: 1,288

Rep: Reputation: 591Reputation: 591Reputation: 591Reputation: 591Reputation: 591Reputation: 591
Is /tmp a separate filesystem or just a subdirectory in the root filesystem?
Code:
df /tmp
 
Old 12-17-2017, 09:12 AM   #3
sevendogsbsd
Senior Member
 
Registered: Sep 2017
Posts: 1,396

Rep: Reputation: 548Reputation: 548Reputation: 548Reputation: 548Reputation: 548Reputation: 548
You can add an entry to /etc/fstab for tmpfs manually or I think systemd can do this also. No clue how to do it in systemd but I am sure there is info out there.

https://wiki.centos.org/TipsAndTricks/TmpOnTmpfs
 
Old 12-17-2017, 09:16 AM   #4
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,194

Rep: Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384
Quote:
Originally Posted by apj View Post
How to mount /tmp with noexec because there is no entry is /etc/fstab in centos 7?
What exactly are you doing that would make this matter?
 
Old 12-17-2017, 10:32 AM   #5
apj
LQ Newbie
 
Registered: Apr 2014
Location: India
Distribution: ubuntu , CentOS , Redhat , AIX
Posts: 17

Original Poster
Rep: Reputation: Disabled
/tmp is just subdirectory under root directory.

I want to mount it with noexec flag.
 
Old 12-17-2017, 02:21 PM   #6
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,511

Rep: Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007
I think what wpeckham is asking is, maybe there a better way to do what you want. Could you explain why you need noexec on /tmp? We can tell you how to do it. But we can't figure out why anyone would want to do it. So, there's probably a better way to do whatever it is you want.
 
Old 12-17-2017, 02:24 PM   #7
MadeInGermany
Senior Member
 
Registered: Dec 2011
Location: Simplicity
Posts: 1,288

Rep: Reputation: 591Reputation: 591Reputation: 591Reputation: 591Reputation: 591Reputation: 591
For mount options you must mount /tmp i.e. it must be a separate filesystem (and needs an entry in /etc/fstab).
Maybe you have 3+GB reserved in the lvm? Then you can create one.

Alternatively, for a subdirectory you can maybe achieve something similar by means of a default ACL. I have not done it yet, please try it yourself: start with reading the man pages
Code:
man chmod
Code:
man setfacl
 
Old 12-17-2017, 02:38 PM   #8
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,360

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
Quote:
Originally Posted by AwesomeMachine View Post
But we can't figure out why anyone would want to do it.
In a situation where users are supposed to be restricted to running specific programs only, you don't want to allow execute permission in any directory where that user also has write permission. It keeps a restricted user from downloading a copy of Doom from the web and executing it.

But, if /tmp is just a root filesystem directory and not a separate filesystem, I don't know how you could give it more restrictive mount options. You could almost do it with a bind-mount, but I don't think it's possible to bind-mount a directory on top of itself. In systems that follow the current recommendation of making /tmp a tmpfs in RAM, it would of course be easy.

[EDIT] On second thought, just create another directory /tmp-r. Then
Code:
mount --bind /tmp-r /tmp
mount -o remount,noexec /tmp
And on third thought, that's not going to work either, as it still leaves the /tmp-r directory exposed. It can work this way:
Code:
mkdir -p /tmp-r/tmp
chmod 700 /tmp-r
chmod 1777 /tmp-r/tmp
mount --bind /tmp-r/tmp /tmp
mount -o remount,noexec /tmp
Now no one but root can reach the writable /tmp-r/tmp directory directly.

Last edited by rknichols; 12-17-2017 at 02:49 PM. Reason: On second thought, ...
 
1 members found this post helpful.
Old 12-17-2017, 05:40 PM   #9
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,194

Rep: Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384
If I had a system I wanted to restrict that far, I would download the sources for IBS (Iron Bound Shell) and compile it for my system, configure it, and and make it the default shell for those restricted users (only). IBS allows me to restrict EXACTLY what commands a user may run.

Another option is to use the passwd and ssh settings to chroot the user into their home folder and restrict that as needed. This allows them to do many thing, but they will not be able to even REACH /tmp.
 
Old 12-17-2017, 06:09 PM   #10
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,360

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
Quote:
Originally Posted by wpeckham View Post
Another option is to use the passwd and ssh settings to chroot the user into their home folder and restrict that as needed. This allows them to do many thing, but they will not be able to even REACH /tmp.
Setting up a chroot for a user requires a lot more than that user's home directory.
 
Old 12-17-2017, 06:17 PM   #11
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,511

Rep: Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007
Even if /tmp is a directory on disk, you can just make it tmpfs if you want.
Code:
$ mount -t tmpfs -o size=512m,noexec tmpfs /tmp
Of course it would initially be disruptive to the system, because all the files in /tmp would disappear. But after you edit /etc/fstab and reboot it would be OK.
 
Old 12-20-2017, 04:56 AM   #12
apj
LQ Newbie
 
Registered: Apr 2014
Location: India
Distribution: ubuntu , CentOS , Redhat , AIX
Posts: 17

Original Poster
Rep: Reputation: Disabled
Thank you so much to all for helping me.
I created one lv and mount /tmp on that and execute mount -o remount,noexec /tmp.
 
Old 12-20-2017, 06:25 AM   #13
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,194

Rep: Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384Reputation: 1384
Quote:
Originally Posted by apj View Post
Thank you so much to all for helping me.
I created one lv and mount /tmp on that and execute mount -o remount,noexec /tmp.
Keep in mind you must also add the fstab entry, or this will only be temporary.
 
Old 12-25-2017, 02:13 AM   #14
apj
LQ Newbie
 
Registered: Apr 2014
Location: India
Distribution: ubuntu , CentOS , Redhat , AIX
Posts: 17

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by wpeckham View Post
Keep in mind you must also add the fstab entry, or this will only be temporary.
Yes sure.

Thank You
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
question regarding noexec,nodev at /tmp mrmnemo Linux - Software 9 10-20-2010 05:06 PM
Beyond noexec on /tmp OffbeatAdam Linux - Security 9 11-24-2009 09:28 PM
Remove noexec from tmp directory Skillz Linux - General 3 11-21-2009 02:36 AM
noexec on /tmp but still stefaandk Linux - Security 10 03-05-2007 07:02 AM
reinstall --> /tmp & noexec issue Fuel Slackware 1 11-30-2004 11:43 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 05:33 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration