Add nodev, nosuid, and noexec options to fstab
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| diskimage-builder |
Fix Released
|
Undecided
|
Yolanda Robla | ||
Bug Description
nodev, nosuid, and noexec are fstab options/(flags?) that can improve security of partitions.
rational for each option:
The nodev mount option prevents files from being interpreted as character or block devices. The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set nodev on these filesystems.
The nosuid mount option can be used to prevent execution of setuid programs from partitions such as temp.
Allowing users to execute binaries from world-writable directories such as /tmp should never be necessary in normal operation and can expose the system to potential compromise.The noexec mount option can be used to prevent binaries from being executed out of /tmp
Each of the above is also requirement in security compliance governance bodies, such as CIS, DISA-STIG etc.
It would be ideal if config directives are present in diskimage-builder, to allow an operator to set those values during image building.
Further reading:
http://
https:/
| Changed in diskimage-builder: | |
| assignee: | nobody → Andreas Florath (ansreas) |
| status: | New → In Progress |
| Andreas Florath (ansreas) wrote | #1 |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to diskimage-builder (master) | #2 |
| Changed in diskimage-builder: | |
| assignee: | Andreas Florath (ansreas) → Yolanda Robla (yolanda.robla) |
| OpenStack Infra (hudson-openstack) wrote Change abandoned on diskimage-builder (master) | #3 |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to diskimage-builder (master) | #4 |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Andreas Florath (ansreas) |
| OpenStack Infra (hudson-openstack) wrote Change abandoned on diskimage-builder (feature/v2) | #5 |
| Andreas Florath (ansreas) wrote | #6 |
| Changed in diskimage-builder: | |
| assignee: | Andreas Florath (ansreas) → Yolanda Robla (yolanda.robla) |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Andreas Florath (ansreas) |
| Changed in diskimage-builder: | |
| assignee: | Andreas Florath (ansreas) → Yolanda Robla (yolanda.robla) |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Andreas Florath (ansreas) |
| Changed in diskimage-builder: | |
| assignee: | Andreas Florath (ansreas) → Yolanda Robla (yolanda.robla) |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Andreas Florath (ansreas) |
| Changed in diskimage-builder: | |
| assignee: | Andreas Florath (ansreas) → Yolanda Robla (yolanda.robla) |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Ian Wienand (iwienand) |
| Changed in diskimage-builder: | |
| assignee: | Ian Wienand (iwienand) → Yolanda Robla (yolanda.robla) |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Andreas Florath (ansreas) |
| Changed in diskimage-builder: | |
| assignee: | Andreas Florath (ansreas) → Ian Wienand (iwienand) |
| Changed in diskimage-builder: | |
| assignee: | Ian Wienand (iwienand) → Yolanda Robla (yolanda.robla) |
| Changed in diskimage-builder: | |
| assignee: | Yolanda Robla (yolanda.robla) → Ian Wienand (iwienand) |
| Changed in diskimage-builder: | |
| assignee: | Ian Wienand (iwienand) → Yolanda Robla (yolanda.robla) |
| OpenStack Infra (hudson-openstack) wrote Fix merged to diskimage-builder (master) | #7 |
| Changed in diskimage-builder: | |
| status: | In Progress → Fix Released |
The latest patch of [1] includes the possibility to define options for fstab, like:
- partitioning:
base: image0
label: mbr
partitions:
- name: home
size: 100M
mkfs:
type: xfs
uuid: b96d9c0d-
mount:
fstab:
Note: it is currently marked as WIP because it is based on the DIB V2 branch which hopefully will be released in the next few days.
[1] https:/