What does NOEXEC flag mean when mounting directories on RHEL?

Question

I am trying to understand the NOEXEC flag when mounting.

I am having an execution issue within the /tmp directory on someone elses machine that I cannot access atm where the /tmp directory is mounted onto a different drive than '/' and NOEXEC is present. I wanted to try and recreate this scenario on my machine, but I do not have a second hard drive. I tried doing the following command:

mount --bind /test1 /test2

I then removed the bind flag and added NOEXEC in /etc/fstab. Then, I created a file in /test2 called test.sh where it just echos 'hello world'. I try and run it and it said 'permission denied'. I then ran chmod 777 test.sh and was able to execute the file just fine. I thought that the NOEXEC flag should not allow me to execute anything?

Is mount --bind /test1 /test2 not the same as mounting from a completely different physical drive? As in /test1 and /test2 are on different drives?

Solution

Option 'NOEXEC' flag in the mount command does not allow the execution of executable binaries in the mounted file system¹. However, when a script (a text file that begins with she-bang line; i.e., a line that begins with #!) is given to some shells (bash), it will run the executable named on that line (e.g., /usr/bin/perl) and pass the path of the shell script as the first argument. The actual interpreter might not be on that mountpoint.
__________
¹ The mount command typically mounts a file system.  (Arguably, loop-back or bind mounts may be considered an exception to this generality.)  In some cases (e.g., /tmp), this file system will contain only one directory.

Comments

[Kamil Maciorowski]

I suspect you may be a victim of some peculiarity of bind mount. See this answer.

[user972276]

So, although the sh file resides in /test2, it is getting executed in /bin/sh, not /test2? On the other machine, there is a java process that is writing shell scripts to the /tmp directory and then executing them. I think I remember the shell scripts it is creating has #!/bin/sh at the top. I do not know how the shell script is getting executed other than its going through java and references /bin/sh. If it is referencing /bin/sh and the bin directory has execute privileges, why wouldnt the shell scripts execute like they did in my test?

[ArchLayperson]

That's all up to the shell/program calling, shell scripts are not ELF's and cannot be directly executed, however some shells, will not allow a script on a FS that is mounted NOEXEC to run, they will just die. I'm not sure what /bin/sh's behavior is supposed to be in this case. (Especially since I dont know which one you are using, there are a few flavors).

[ArchLayperson]

Come to think of it, when you use the shell, the system notices the #! line, and calls the appropriated interpereter (/bin/bash /tmp/file.sh), but if the java bit is just calling (/tmp/file.sh), that is not going to work.

[Kamil Maciorowski]

In my opinion your answer wrongly claims it's the shell's job to read a shebang. See this answer.

[ArchLayperson]

@Kamil While that is normally true, some shells check for shebangs separately. I'm looking at you pfksh...

[ArchLayperson]

Edited to cover the primary case, where the shell handles the shebang, and doesn't do anything strange to it. I was also less well-informed when I wrote this.