openstack/ansible-hardening
Code Issues Proposed changes

V-3865{2,4}, V-57569: Mounting filesystems

Browse Source 
Implements: blueprint security-hardening

Change-Id: I490ee1d330e2bc0e47321a3c0e8340470ec7d865
This commit is contained in:
Major Hayden 2015-10-07 17:30:05 -05:00
parent bfcf6c7423
commit a399061cab
3 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc/source/developer-notes/V-38652.rst Normal file
View File

@ -0,0 +1,5 @@
**Exception**
Although neither Ubuntu 14.04 or openstack-ansible mount remote filesystems
by default, deployers are urged to use the ``nodev`` option on any remotely
mounted filesystems whenever possible.

6
doc/source/developer-notes/V-38654.rst Normal file
View File

@ -0,0 +1,6 @@
**Exception**
Although neither Ubuntu 14.04 or openstack-ansible mount remote filesystems
by default, deployers are urged to use the ``nosuid`` option on any remotely
mounted filesystems whenever possible.

6
doc/source/developer-notes/V-57569.rst Normal file
View File

@ -0,0 +1,6 @@
**Exception**
Altering partitions and how they are mounted is left up to the deployer
to configure during the OS installation process. Mounting ``/tmp/``
with the ``noexec`` option is highly recommended to prevent scripts
or binaries from being executed from ``/tmp``.