Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop letting setuid binaries bypass your user permissions

🧩 The Challenge

You’ve finally locked down a directory, but some random user is still managing to modify system files because they’re running a binary with the SUID bit set. I spent an entire morning chasing a ghost user before realizing a legacy utility was escalating privileges right under my nose.

💡 The Fix

Use the nosuid mount option on your filesystems to prevent those dangerous bits from ever taking effect. It’s the easiest way to kill privilege escalation vectors on data partitions.

mount -o remount,nosuid /home

⚙️ Why It Works

Setting this flag tells the kernel to ignore the setuid and setgid bits entirely for any binary executed from that specific mount point. Even if someone manages to chmod +s a file in that directory, the system won’t honor the elevation.

🚀 Pro-Tip: Always check your /etc/fstab for this on partitions where users store their own uploaded binaries.

Linux Tips & Tricks | © ngelinux.com | 9/3/2026