noexec를 사용하여 /dev/shm 마운트

RHEL/CentOS 7.9에서는 기본적으로tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,seclabel)

보안 규칙에 따르면 보안 옵션 nosuid, nodev 및 nosuid를 사용하여 설치해야 합니다.실행되지 않음.

noexecRHEL이 이미 다른 두 개를 사용하고 있는데 이를 자동으로 포함 하지 않는 이유는 무엇입니까 ?

이 옵션(설명 포함)을 독점적으로 사용하는 것이 noexec좋은 생각입니까, 나쁜 생각입니까 /dev/shm? 이것이 좋은 생각이라면 해당 마운트 문이 존재하지 않으므로 이를 구현하는 방법/etc/fstab

참조: U_RHEL_7_V3R6_STIG_SCAP_1-2_Benchmark.zip

인터넷상의 누구나 다운로드할 수 있습니다.https://public.cyber.mil/stigs/downloads/Operating Systems/redhat7에서 다음을 읽어보세요.

Rule Title: The Red Hat Enterprise Linux operating system must
            mount /dev/shm with secure options.

Discussion: The "noexec" mount option causes the system to not execute
            binary files. This option must be used for mounting any file
            system not containing approved binary files as they may be
            incompatible. Executing files from untrusted file systems 
            increases the opportunity for unprivileged users to attain 
            unauthorized administrative access.

The "nodev" mount option causes the system to not interpret character or
block special devices. Executing character or block special devices from 
untrusted file systems increases the opportunity for unprivileged users 
to attain unauthorized administrative access.

The "nosuid" mount option causes the system to not execute "setuid" and 
"setgid" files with owner privileges. This option must be used for 
mounting any file system not containing approved "setuid" and "setguid" 
files. Executing files from untrusted file systems increases the 
opportunity for unprivileged users to attain unauthorized administrative 
access.

Check Text: Verify that the "nodev","nosuid", and "noexec" options are
            configured for /dev/shm:

cat /etc/fstab | grep /dev/shm

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

If results are returned and the "nodev", "nosuid", or "noexec" options
are missing, this is a finding.

Verify "/dev/shm" is mounted with the "nodev", "nosuid", and "noexec" 
options:  mount | grep /dev/shm

tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel)

If /dev/shm is mounted without secure options "nodev", "nosuid", and 
"noexec", this is a finding.

Fix Text: Configure the system so that /dev/shm is mounted with the
          "nodev", "nosuid", and "noexec" options by adding /modifying 
          the /etc/fstab with the following line:

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0