Message-ID: <7b2ab61d-f076-45c4-a64d-757d4b0e8a1b@steeph.de>
Date: Sun, 10 Aug 2025 19:59:37 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Mount option `noexec` not working as expected?
To: ~alpine/users@lists.alpinelinux.org
References: <CALVR4_07MK9b_eUBydkuw4EOLvcerPZkp_7iBZnXr-2wLbEFbQ@mail.gmail.com>
Content-Language: en-US
From: steeph <ml@steeph.de>
In-Reply-To: <CALVR4_07MK9b_eUBydkuw4EOLvcerPZkp_7iBZnXr-2wLbEFbQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi!

This is normal behaviour. hello.sh is not executable, but ash is and 
still can take hello.sh as an argument. Neither noexec nor removing exec 
permission from hello.sh can prevent ash from being executed and reading 
hello.sh.

Best regards
steeph


On 8/10/25 19:50, Rolf wrote:
> Dear friends
>
> Alpine 3.22.1 x86_64
>
> In my `/etc/fstab`, there is the following entry for my data
> partition, as suggested in
> https://wiki.alpinelinux.org/wiki/Securing_Alpine_Linux#User_and_access_management,
> "2. Configure mount options":
> 'UUID=<uuid>  /vol/ext4  ext4  defaults,nosuid,nodev,noexec 0 2'
>
> However, shell scripts in /vol/ext4/bin appear to be executable by the
> owner all the
> same:
> ```
> $ ls -l /vol/ext4/bin/
> total 4
> -rwx------    1 <user>    <group>           24 Aug 10 18:55 hallo.sh
> $ ./hallo.sh
> /bin/ash: ./hallo.sh: Permission denied
> $ $ ash ./hallo.sh
> hallo!
> ```
>
> If done by a different user:
> ```
> $ ./hallo.sh
> -ash: ./hallo.sh: Permission denied
> $ ash ./hallo.sh
> ash: can't open './hallo.sh': Permission denied
> ``
>
> Is there something I have misunderstood about the concept of the `noexec`
> option and shell scripts, or have I misconfigured something?
>
> Many thanks and best regards
>
> Rolf