Details

The nosuid mount option specifies that the filesystem cannot contain setuid files.

Rationale:

Setting this option on a file system prevents users from introducing privileged programs

onto the system and allowing non-root users to execute them.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the /etc/fstab file and add nosuid to the fourth field (mounting options) of all
removable media partitions. Look for entries that have mount points that contain words
such as floppy or cdrom. See the fstab(5) manual page for more information.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/2420

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6
• CSCv6|13
• CSCv7|5.1

Source

• Tenable.com/audits