Add nosuid Option to /boot
An XCCDF Rule
Description
The nosuid mount option can be used to prevent
execution of setuid programs in /boot. The SUID and SGID permissions
should not be required on the boot partition.
Add the nosuid option to the list of
Options in the systemd.mount unit that
controls mounting of
/boot.
Rationale
The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from boot partitions.
- ID
- xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid
- Severity
- Medium
- References
- Updated