documentation_complete: true


title: 'Add nosuid Option to /boot/efi'

description: |-
    The <tt>nosuid</tt> mount option can be used to prevent
    execution of setuid programs in <tt>/boot/efi</tt>. The SUID and SGID permissions
    should not be required on the boot partition.
    {{{ describe_mount(option="nosuid", part="/boot/efi") }}}

rationale: |-
    The presence of SUID and SGID executables should be tightly controlled. Users
    should not be able to execute SUID or SGID binaries from boot partitions.

{{{ complete_ocil_entry_mount_option("/boot/efi", "nosuid") }}}

severity: medium

identifiers:
    cce@rhel8: CCE-86038-7
    cce@rhel9: CCE-86040-3

references:
    nist: CM-6(b),CM-6.1(iv)
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol8: OL08-00-010572

platform: mount[boot-efi]

template:
    name: mount_option
    vars:
        mountpoint: /boot/efi
        mountoption: nosuid
        exclude_filesystem_type: vfat
    backends:
        anaconda: "off"

fixtext: |-
    {{{ fixtext_mount_option("/boot/efi", "nosuid") }}}

srg_requirement: '{{{ srg_requirement_mount_option("/boot/efi", "nosuid") }}}'
