jperezduerto.info
Security in depth · Unit 22 · Lesson 21 of 44
Mount options have specific jobs
Match mount restrictions to the exact path and operation being reviewed.
Helpful before thisLinux privilege escalation
After this lesson you can
- Explain why a read-only parent mount does not prove that a separate nested mount is read-only.
A familiar path can cross into a mount with different rules.
Restrictions have specific meanings
A read-only mount limits writes through that mount. The noexec option restricts direct execution; nosuid suppresses executable set-ID and file-capability effects there; nodev prevents interpreting device special files there. These options do not determine whether a document is trustworthy.
Review the effective mount used for the operation. A separate nested mount can have different restrictions from its parent. A policy written for a directory name is incomplete if it ignores those boundaries.
Supplied record: the community archive
The fictional archive worker is approved to read published records and write incoming documents only in its imports area. The current mount review says:
/archive: read-only, noexec, nosuid, nodev.
/archive/imports: separate writable mount, noexec, nosuid, nodev.
Worker permissions: allow reading records and writing imports.
Service owner: incoming documents still require validation before publication.
Assume these are the effective mounts in the worker’s own mount view. There are no alternate paths or extra restrictions affecting the described operations. Writes through the archive mount are restricted, while the separate imports mount permits the approved document writes.
Avoid a broader claim
Write two policy rows, one for each mount. The archive row should describe protected published records; the imports row should identify the deliberate writable intake area. Calling the whole directory tree immutable would contradict the supplied record.
Keep document validation and reader authorization as separate requirements. The listed options neither approve a submitted file nor decide who should see its contents. Recheck the intended boundaries when mounts change, rather than inheriting confidence from yesterday’s parent-path label.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which statement is justified by the archive worker record?
Show the answer
Correct answer: The worker cannot write through the read-only archive mount, but its separate imports mount permits the approved writes. The record names distinct active mounts. The parent restriction does not replace the independently recorded writable setting of the nested mount.
Try it
- WriteWrite a two-row policy note for the archive and its imports mount. Record intended writes, active restrictions, and one separate check for the safety of uploaded content.