3 ms·
Interestingly the method of mitigation, which is mounting user-accessible filesystems nosuid, has become less and less common over the years. When dinosaurs st
by cnvogel 16y ago
Interestingly the method of mitigation, which is mounting user-accessible filesystems nosuid, has become less and less common over the years.
When dinosaurs still roamed the earth, it used to be that all unix installs used separate /, /var, /usr, (/export)/home, ... directories, the rationale being mostly to facilitate remote mounting of shared (/usr) programs or to isolate filesystem corruptions (/ being mostly read-only and containing essential binaries).
But its quite convenient to have each of them mounted with adequate, security and performance enhancing mount options (in Linux for example: /=noatime, /usr=nodev,noatime, /var,/tmp,/home=nodev,nosuid).
I used this scheme for quite a long time and only recently abandoned it here and there because popular Linux distributions, or e.g. OpenSolaris ZFS-root no longer offer it on their default install media. And of course it wastes a little space having to judge the maximum expected size when installing the machine.
- nodata 16y agoI think this change is mostly due admin time per machine. Even if you use LVM your admin time per machine is higher if you have lots of separate partitions. btw you might want relatime rather than noatime.
- eru 16y agoActually, you might want relatime rather than atime. Noatime is fine, if you do not rely on read access times, i.e. almost all situations.
- nodata 16y agoThe problem is that you don't really know which applications do rely on read access times, and because the performance jump between atime<->noatime and atime<->relatime is pretty much the same, I always go for the safer option.
- eru 16y agoI agree. Just use relatime by default and be done with it. (Though I have usually gone without atime, and just made a partition for my emails with atime to make mutt happy.)