Date: Sat, 31 May 2003 21:51:03 -0400 (EDT) From: Brian Minard <bminard@flatfoot.ca> To: FreeBSD-gnats-submit@FreeBSD.org Subject: docs/52829: [PATCH] Installing FreeBSD: Benefits of multiple filesystems Message-ID: <200306010151.h511p3MG001650@spud.flatfoot.ca> Resent-Message-ID: <200306010200.h5120T0A057734@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 52829 >Category: docs >Synopsis: [PATCH] Installing FreeBSD: Benefits of multiple filesystems >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-doc >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Sat May 31 19:00:29 PDT 2003 >Closed-Date: >Last-Modified: >Originator: Brian Minard >Release: FreeBSD 4.8-STABLE i386 >Organization: >Environment: System: FreeBSD spud.flatfoot.ca 4.8-STABLE FreeBSD 4.8-STABLE #0: Mon May 19 21:28:08 EDT 2003 root@spud.flatfoot.ca:/usr/obj/usr/src/sys/SPUD i386 >Description: The installation chapter lists several benefits for creating multiple filesystems. An important consideration which might not be apparent to new users until after they complete the installation is that you cannot mount user-writable file systems nosuid if you don't put them in a separate filesystem. This is worth emphasizing, as security(7) makes this recommendation. >How-To-Repeat: Follow the installation instructions for allocating disk space--they are (strongly) biased towards leading users to create /home under /usr. >Fix: --- chapter.sgml.orig Sat May 31 12:30:21 2003 +++ chapter.sgml Sat May 31 21:43:40 2003 @@ -1747,7 +1747,13 @@ <para>Different filesystems can have different <firstterm>mount options</firstterm>. For example, with careful planning, the root filesystem can be mounted read-only, making it impossible for - you to inadvertently delete or edit a critical file.</para> + you to inadvertently delete or edit a critical file. As well, + separating the filesystem containing <filename>/home<filename>, + from other filesystems means that user-writable filesystems can be + mounted <firstterm>nosuid</firstterm>. This will prevent the + <firstterm>suid/guid<firstterm> bits on executables stored in + <filename>/home</filename> from taking effect, possibly improving + security.</para> </listitem> <listitem> >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200306010151.h511p3MG001650>