Add nosuid Option to /opt
Mounts the /opt partition with the nosuid option so setuid/setgid bits on third-party software are ignored.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The presence of SUID and SGID executables must be tightly controlled. /opt holds add-on / third-party software packages whose binaries should not normally need setuid/setgid privileges. Mounting /opt with nosuid makes the kernel ignore those bits, reducing the risk that a vulnerable or malicious third-party SUID binary becomes a privilege-escalation vector.
What Pavois checks
Pavois reads the effective mount via mount('/opt') and asserts the resolved options include nosuid. The live mount table reflects the kernel's real state, including options from systemd mount units or a remount, which a static read of /etc/fstab could misrepresent. If /opt is not a separate mount point, there is no dedicated partition to harden.
describe mount('/opt') do
its('options') { should include 'nosuid' }
end
describe command("{ findmnt --fstab -no OPTIONS /opt 2>/dev/null; grep -hsE '[[:space:]]/opt[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /opt 2>/dev/null) 2>/dev/null; } | grep -ow 'nosuid'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /opt (or findmnt -no OPTIONS /opt) and confirm nosuid is present, e.g. rw,nosuid,nodev,relatime.
Inspect & investigate
Use findmnt /opt to inspect the active options. A SUID binary run from a nosuid mount executes without elevated privileges; auditd EXECVE/SYSCALL records in /var/log/audit/audit.log can corroborate execution attempts.
Remediation
This rule has no automated harden plan: apply it manually. Add nosuid to the /opt line in /etc/fstab (e.g. defaults,nodev,nosuid), then mount -o remount /opt and verify with findmnt /opt.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/opt -v o=nosuid '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /opt && mount -o remount,nosuid /opt || true |
|---|---|
| name | mount-opt-nosuid |
| not_if | awk -v m=/opt '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx nosuid |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without nosuid, a third-party SUID binary in /opt could be exploited for privilege escalation. Precaution: some commercial or packaged software installed under /opt legitimately ships SUID/SGID helpers (certain VPN clients, backup agents, container runtimes). Inventory /opt for setuid files first, find /opt -perm /6000 -type f, and confirm none are required before applying. If /opt is not a separate partition, do not apply nosuid to /. The remount is reversible; test affected applications afterward.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.