documentation_complete: true

title: 'Add nosuid Option to Removable Media Partitions'

description: |-
    The <tt>nosuid</tt> mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect.
    These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively.
    Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removeable media.
    <mount-desc-macro option="nosuid" part="any removable media partitions" />

rationale: |-
    The presence of SUID and SGID executables should be tightly controlled.
    Allowing users to introduce SUID or SGID binaries from partitions mounted off of removable media would allow them to introduce their own highly-privileged programs.

severity: unknown
