Re: [gentoo-dev] Making procfs mount as nosuid,noexec by default

[Doug Goldstein]

Daniel Drake wrote:
> Hi,
>
> The local root exploit-of-the-week would have been unable to run if our
> users systems had /proc mounted with nosuid and/or noexec
>
> It would be worthwhile considering making this a default. What are
> people's thoughts?
>
> Additional testing of this change would be appreciated (just ensure that
> nothing breaks). To do it as a one off:
>
> # mount -o remount,nosuid,noexec /proc
>
> To make it more permanent, /etc/fstab has:
>
>     proc    /proc    proc        defaults        0 0
>
> Change to:
>
>     proc    /proc    proc        nosuid,noexec        0 0
>
>
> Thanks,
> Daniel

Daniel,

Turns out that yesterday after we talked about this. I've been running
one of my boxes like that for ages. So far so good.

-- 
Doug Goldstein <cardoe@g.o>
http://dev.gentoo.org/~cardoe/