`nosuid` and probably `nodev` should IMO be the default filesystem mount options. `/dev` is already a special devtmpfs and the initrd minimal /dev can just explicitly mount the initrd tmpfs rootfs with `dev` and `suid` if necessary. Letting SUID binaries just "exist" anywhere is a stupendous security issue. What if you mount some external storage medium, how are you to verify that none of the SUID binaries on that bl…
Without read permissions you cannot execute the binary, that would not make any sense. To execute the binary it needs to be read from disk and loaded into memory. In fact if you have read permissions but not executable permissions on a specific binary then you can still execute it by calling the linker directly /bin/ld.so.1 /path/to/binary (the linker will read and load the binary and then jump to the entry point wit…
This is not correct, as when the binary is setuid-someone-else, you are not the one executing it; they are.
$ cat hello.c
#include
int main(void)
{
(void) puts("Hello, world!");
return 0;
}
$ clang-21 -Weverything hello.c -o hello
$ sudo chown root:root hello
$ sudo chmod 4711 hello
$ ls -l hello
-rws--x--x 1 root root 16056 Apr 30 22:22 hello
$ ./hello
Hello, world!
$ id
uid=1000(aaron) gid=1000(aaron) groups=1000(aaron),27(sudo),46(plugdev),100(users)