Mount options nosuid, nodev and noexec shrink what a writable partition can be used for. Apply nosuid and nodev to almost every mount that holds data, and add noexec to places like /tmp and upload directories if your software allows. Test first, because some installers and tools run from temp space.
What each option does
The mount manual page is short on each one:
- nosuid: do not honor set-user-ID and set-group-ID bits or file capabilities when executing programs from this file system. It also affects SELinux domain transitions, which need a specific permission when it is set.
- nodev: do not interpret character or block special devices on the file system. Without it, a device node dropped on a data disk could be used to reach hardware.
- noexec: do not permit direct execution of any binaries on the mounted file system.
Notice the word "direct" in the last one. It does not prevent a shell or interpreter from reading and running a script that sits on that disk, for example sh /tmp/x.sh or python /tmp/x.py. So noexec stops casual drop and run attacks, not a determined attacker who can start a shell.
Where to apply them
| Mount | nosuid | nodev | noexec |
|---|---|---|---|
/tmp, /var/tmp | yes | yes | yes, if tools allow |
/home | yes | yes | depends on developer needs |
/var/www uploads, data volumes | yes | yes | yes |
/boot | yes | yes | often yes |
/ | no | no | no |
Package managers sometimes run scripts from /tmp, so a noexec temp mount can break updates. Test with your update tool before you roll it out, and know the workaround for that tool.
How to set them
Add options in the fourth field of /etc/fstab:
tmpfs /tmp tmpfs defaults,nosuid,nodev,noexec,size=2G 0 0
Then mount -o remount /tmp, or reboot. A caution from the manual: you can change nosuid, nodev, noexec and a few others on a bind mount using remount,bind, but the original file system's flags are not affected and recursive changes are not possible.
Options like user, users and group that let ordinary users mount media already imply nosuid and nodev, and user and users imply noexec as well, unless you override them later in the list. Watch for an override such as user,exec,dev,suid, which undoes the safety.
Check what you have
findmnt -o TARGET,OPTIONS prints every mount with its options. Look for data partitions missing nosuid or nodev. Put the output into your host baseline so drift stands out.
Combine this with reviewing setuid files and with systemd settings such as PrivateTmp, covered in the basic sandbox directives.
Safeguard offers asset discovery and policy checks around your pipeline, and a free scan is at gold.safeguard.sh/scan.
Quick check
Does noexec stop sh /tmp/script.sh?
No. It blocks direct execution of binaries on that mount, but an interpreter on another file system can still read and run the script.
Which option ignores setuid bits?
nosuid. It also ignores file capabilities when running programs from that mount.
Sources
Last reviewed: 19 October 2026.
