Add noexec Option to /home
Mounts the /home partition with the noexec option so users cannot execute binaries from their home directories.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/home contains the writable data of individual users. Binaries there must not be treated as trusted, and users should not be able to execute them. Mounting /home with noexec prevents running any program stored under a user's home directory, blocking a common path for malware and unauthorized tools that an unprivileged user (or an attacker who compromised their account) could drop and run.
What Pavois checks
Pavois reads the effective mount via mount('/home') and asserts the resolved options include noexec. The live mount table reflects what the kernel actually applied, including options from systemd mount units or a remount, which a static read of /etc/fstab could misrepresent. If /home is not a separate mount point, there is no dedicated partition to harden.
describe mount('/home') do
its('options') { should include 'noexec' }
end
describe command("{ findmnt --fstab -no OPTIONS /home 2>/dev/null; grep -hsE '[[:space:]]/home[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /home 2>/dev/null) 2>/dev/null; } | grep -ow 'noexec'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /home (or findmnt -no OPTIONS /home) and confirm noexec is present, e.g. rw,nosuid,nodev,noexec,relatime.
Inspect & investigate
Use findmnt /home to inspect the active options. Running a binary from a noexec mount fails with Permission denied; auditd EXECVE denials in /var/log/audit/audit.log can surface blocked attempts, which is a useful indicator of users running unauthorized tools.
Remediation
This rule has no automated harden plan: apply it manually. Add noexec to the /home line in /etc/fstab (e.g. defaults,nodev,nosuid,noexec), then mount -o remount /home and verify with findmnt /home.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/home -v o=noexec '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /home && mount -o remount,noexec /home || true |
|---|---|
| name | mount-home-noexec |
| not_if | awk -v m=/home '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx noexec |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
noexec on /home is the most disruptive of the mount options: it breaks any legitimate workflow where users run programs from their home, developer toolchains, pip install --user, language version managers (rbenv, nvm, cargo), local scripts, and some build/CI agents. Precautions: survey real usage first; on multi-user developer or build hosts this option is often inappropriate. If /home is not a separate partition, never apply noexec to /, which would render the system unusable. The remount itself is reversible, but test interactive and automated user workflows before keeping it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
| NIST | CM-6(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.