Subject: Mount option `noexec` not working as expected?

From: Rolf <[email-masked]>
Date: Sun, 10 Aug 2025 19:50:19 +0200

Dear friends

Alpine 3.22.1 x86_64

In my `/etc/fstab`, there is the following entry for my data
partition, as suggested in
https://wiki.alpinelinux.org/wiki/Securing_Alpine_Linux#User_and_access_management,
"2. Configure mount options":
'UUID=<uuid>  /vol/ext4  ext4  defaults,nosuid,nodev,noexec 0 2'

However, shell scripts in /vol/ext4/bin appear to be executable by the
owner all the
same:
```
$ ls -l /vol/ext4/bin/
total 4
-rwx------    1 <user>    <group>           24 Aug 10 18:55 hallo.sh
$ ./hallo.sh
/bin/ash: ./hallo.sh: Permission denied
$ $ ash ./hallo.sh
hallo!
```

If done by a different user:
```
$ ./hallo.sh
-ash: ./hallo.sh: Permission denied
$ ash ./hallo.sh
ash: can't open './hallo.sh': Permission denied
``

Is there something I have misunderstood about the concept of the `noexec`
option and shell scripts, or have I misconfigured something?

Many thanks and best regards

Rolf

---

From: steeph <[email-masked]>
Date: Sun, 10 Aug 2025 19:59:37 +0200

Hi!

This is normal behaviour. hello.sh is not executable, but ash is and 
still can take hello.sh as an argument. Neither noexec nor removing exec 
permission from hello.sh can prevent ash from being executed and reading 
hello.sh.

Best regards
steeph

---

From: Rolf <[email-masked]>
Date: Sun, 10 Aug 2025 22:21:45 +0200

Dear donoban,
dear steeph

Many thanks for your prompt answers.

It's a bit embarrassing I had to ask this question, but I read the man
page for `mount` and
googled before writing to the mailing list, without having found and
answer, and apparently
without having fully understood the consequences of the concept of `noexec`.

I'm really grateful for your explanations!

Best regards

Rolf

---

From: donoban <[email-masked]>
Date: Sun, 10 Aug 2025 19:07:50 +0000

> hallo!

When you do this it only needs read permission since you are asking
'/bin/ash' (which can ben executed) to read and parse it.

> ash: can't open './hallo.sh': Permission denied

Has this user permission to read the file?