documentation_complete: true

prodtype: rhel7

title: 'Mount Remote Filesystems with noexec'

description: '<mount-desc-macro option="noexec" part="any NFS mounts" />'

rationale: |-
    The noexec mount option causes the system not to execute binary files. This option must be used
    for mounting any file system not containing approved binary files as they may be incompatible. Executing
    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized
    administrative access.

severity: medium

identifiers:
    cce@rhel7: 80436-9

references:
    disa: 366
    nist: AC-6
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "021021"

ocil_clause: 'the setting does not show'

ocil: |-
    To verify the <tt>noexec</tt> option is configured for all NFS mounts, run the following command:
    <pre>$ mount | grep nfs</pre>
    All NFS mounts should show the <tt>noexec</tt> setting in parentheses.  This is not applicable if NFS is
    not implemented.
