documentation_complete: true

title: 'Mount Remote Filesystems with nosuid'

description: '<mount-desc-macro option="nosuid" part="any NFS mounts" />'

rationale: |-
    NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables
    should be installed to their default location on the local filesystem.

severity: medium

identifiers:
    cce: 26972-0

references:
    srg: SRG-OS-999999
    stigid: RHEL-06-000270

ocil_clause: 'the setting does not show'

ocil: "To verify the <tt>nosuid</tt> option is configured for all NFS mounts, run the following command:\n<pre>$ mount | grep nfs</pre>\nAll NFS mounts should show the <tt>nosuid</tt> setting in parentheses.  This is not applicable if NFS is \nnot implemented."
