Skip to contentSkip to conversation

mount.2: document SELinux use of MS_NOSUID mount flag

PATCH In review Topi Miettinen 2 participants 2 messages Jun 12, 2021 – Jun 20, 2021

Subsystems (2)
SELinux security module Man-pages: manual pages for Linux -- Sections 2, 3, 4, 5, and 7
lore
Share & tools
lore

Topi Miettinen

author
#0 lore raw

PATCH 1/1 mount.2: document SELinux use of MS_NOSUID mount flag

Using mount flag MS_NOSUID also affects SELinux domain transitions but this has not been documented well.

Signed-off-by Topi Miettinen <[email protected]>
---
 man2/mount.2 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
man2/mount.2 +3 -1
index d8521880b..d7d5b2ad4 100644
@@ -220,7 +220,9 @@ Do not allow programs to be executed from this filesystem.
 .TP
 .B MS_NOSUID
 Do not honor set-user-ID and set-group-ID bits or file capabilities
-when executing programs from this filesystem.
+when executing programs from this filesystem. In addition, SELinux domain
+transitions require permission nosuid_transition, which in turn needs
+also policy capability nnp_nosuid_transition.
 .\" (This is a security feature to prevent users executing set-user-ID and
 .\" set-group-ID programs from removable disk devices.)
 .TP
Signature · 1 line
2.30.2
#1 lore raw

Helo Topi,

Quoted 4 lines · Topi Miettinen

Using mount flag MS_NOSUID also affects SELinux domain transitions but this has not been documented well.

Signed-off-by Topi Miettinen <[email protected]>

Thanks. Patch applied.

Cheers,

Michael

Quoted 20 lines
---
 man2/mount.2 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
man2/mount.2 +3 -1
index d8521880b..d7d5b2ad4 100644
@@ -220,7 +220,9 @@ Do not allow programs to be executed from this filesystem.
 .TP
 .B MS_NOSUID
 Do not honor set-user-ID and set-group-ID bits or file capabilities
-when executing programs from this filesystem.
+when executing programs from this filesystem. In addition, SELinux domain
+transitions require permission nosuid_transition, which in turn needs
+also policy capability nnp_nosuid_transition.
 .\" (This is a security feature to prevent users executing set-user-ID and
 .\" set-group-ID programs from removable disk devices.)
 .TP
Signature · 3 lines
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/