Editing Noexec

{{Header}}
{{Title
|title=noexec
}}
{{#seo:
|description=Secure Mount Options for better Security Hardening.
}}
{{intro|
Secure Mount Options for better Security Hardening

It is planned to mount the user's <code>/home/user</code> folder with <code>noexec</code> by default.
}}

This is part of:

* the [[Security Roadmap|Kicksecure Security Roadmap]],
* the [[Dev/Strong_Linux_User_Account_Isolation|Strong Linux User Account Isolation]] design,
* also related to [[SUID Disabler and Permission Hardener|SUID Disabler and Permission Hardener]].

This will supplemented this at a later time:

* [https://phabricator.whonix.org/T941 lock down interpreters / compilers (interpreter lock) (compiler lock)]
* [[Dev/boot_modes|Multiple Boot Modes for Better Security: an Implementation of Untrusted Root]]

The goal of all of this is that it becomes harder for a Linux user account that might have been compromised by malware to compromise other Linux user accounts or VM escape.

The policy of [[Reasons_for_Freedom_Software#No_Intentional_User_Freedom_Restrictions|No Intentional User Freedom Restrictions]] remains in place as always.

= Related =
* [[Dev/remount-secure]]
* https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707

= Footnotes =
{{reflist|close=1}}
{{Footer}}
[[Category:Design]]
Description	What you type	What you get
Italic	''Italic text''	Italic text
Bold	'''Bold text'''	Bold text
Bold & italic	'''''Bold & italic text'''''	*Bold & italic text*
Description	What you type	What you get
Reference	Page text.<ref>[https://www.example.org/ Link text], additional text.</ref>	Page text.^[1]
Named reference	Page text.<ref name="test">[https://www.example.org/ Link text]</ref>	Page text.^[2]
Additional use of the same reference	Page text.<ref name="test" />	Page text.^[2]
Display references	<references />	↑ Link text, additional text. ↑ Link text