On Mon, 23 Jun 2003, Socketd wrote: > Would it be possible to have this configuration and not having the > system fail (because of lacking rights or something): > > /tmp and /var/tmp noexec (I know /tmp has to be execuable to make > world) > > /var nosuid (what about even noexec?)
I think package installs may rely on the ability to execute install-time pieces, but I'm not entirely sure. nosuid will probably work fine for these, but noexec could trigger problems; try installing a few packages under a descending ktrace. If that's not a concern (i.e., you don't install software in the steady state), then you're probably OK. > /var/mail noexec nosuid would be fine here also. > /home nosuid (again what about noexec if I don't have shell users, > but only websites and backup's on /home?) > > Can nodev also be added to all above + /usr? nodev prevents opening specfs character devices, but doesn't prevent opening fifos or UNIX domain sockets, so is generally fine for all file systems except /dev. The common exceptions I bump into are: (1) If you have per-user chroots, make sure wherever their custom /dev is isn't nodev. (2) The linux port used to (may still) install with a null device under /usr in the compat tree. Mounting this with nodev will break opening /dev/null for Linux apps. I'm not sure why the null entry exists there, and in fact we know it needs to go away since it will break when we GC major device numbers. Robert N M Watson FreeBSD Core Team, TrustedBSD Projects [EMAIL PROTECTED] Network Associates Laboratories _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "[EMAIL PROTECTED]"