How do I mount /tmp as a separate filesystem (/root/images/tmpfile.bin) with the noexec,nosuid, nodev options under Linux like operating systems?

Linux and Unix like operating system can mount system partitions with additional options. These options can cane enhances the security of your server. These options are set in the file /etc/fstab. You can use the following option to control malicious behavior or make it difficult for attackers to exploit your server:
Tutorial details
Difficulty level Intermediate
Root privileges Yes
Requirements Linux
Est. reading time N/A
  1. nodev – Do not interpret character or block special devices on the file system.
  2. noexec – Do not allow direct execution of any binaries on the mounted filesystem.
  3. nosuid – Do not allow set-user-identifier or set-group-identifier bits to take effect.


First, create a file called /root/images/tmpfile.bin as follows :
# mkdir -p /root/images/
# dd if=/dev/zero of=/root/images/tmpfile.bin bs=1 count=0 seek=4G

Format the file system using the mkfs.ext4 command:
# mkfs.ext4 /root/images/tmpfile.bin
Sample outputs:

mke2fs 1.41.12 (17-May-2010)
/root/images/tmpfile.bin is not a block special device.
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
262144 inodes, 1048576 blocks
52428 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=1073741824
32 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736
Writing inode tables: done                            
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 37 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.

Add nodev, nosuid, and noexec options and mount the file system at /tmp
# mount -o loop,rw,nodev,nosuid,noexec /root/images/tmpfile.bin /tmp
# chmod 1777 /tmp

Type the following command to bind mount the /var/tmp directory onto /tmp:
# mount -o rw,noexec,nosuid,nodev,bind /tmp /var/tmp

Update /etc/fstab

Edit the file /etc/fstab, enter:
# vi /etc/fstab
Modify /tmp line as follows:

/root/images/tmpfile.bin   /tmp   ext4    rw,noexec,nosuid,nodev,bind    0 0

Append the following line:

/tmp /var/tmp none rw,noexec,nosuid,nodev,bind 0 0

Save and close the file.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 5 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf duf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Modern utilitiesbat exa
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg glances gtop jobs killall kill pidof pstree pwdx time vtop
Searchingag grep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
5 comments… add one
  • oskar Jun 11, 2013 @ 1:32

    appears that after a reboot the partitions get unmounted despite that i edited on fstab, any clue why?

  • Ben Daughtry Sep 11, 2013 @ 14:49

    Great writeup. Small error: When modifying the /etc/fstab, you don’t want to bind-mount the file to /tmp because its not a directory. The line should actually look like:
    /root/images/tmpfile.bin /tmp ext4 rw,noexec,nosuid,nodev,bind 0 0

  • Ben Daughtry Sep 11, 2013 @ 14:51

    Great writeup. Small error: When modifying the /etc/fstab, you don’t want to bind-mount the file to /tmp because its not a directory. The line should actually look like:
    /root/images/tmpfile.bin /tmp ext4 rw,noexec,nosuid,nodev 0 0

    Sorry about posting twice. First comment had an error

  • Jim Oct 11, 2013 @ 23:35

    In addition to Ben’s comment, you may also need to add the loop option for the file system to mount correctly at boot. You may be getting errors such as:

    mount: /root/images/tmpfile.bin is not a block device (maybe try `-o loop’?)

    To fix, just change the line in /etc/fstab to:

    /root/images/tmpfile.bin /tmp ext4 loop,rw,noexec,nosuid,nodev 0 0

  • Jim Oct 11, 2013 @ 23:45

    Also, you can check the fstab file with the command:

    mount -a

    Fix any errors before rebooting so that your new tmp will be mounted at boot

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum