Is there a way to modify the mount options for an encrypted home partition on Ubuntu, specifically to remove the nosuid option?

Relatedly, is removing nosuid likely to cause any difficulties mounting the encrypted home?

Adding more details because the original question was ambiguous.

I'm trying to build a project that requires it not be on a drive mounted with the nosuid mount option. Recently, after the update to Trusty, it started complaining about nosuid.

I checked fstab, but didn't see the option in use:

$ cat /etc/fstab

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    nodev,noexec,nosuid 0       0
UUID=<snip> /               ext4    errors=remount-ro 0       1

So I checked /proc/mounts, and it looks like my home folder is a VFS mount used by eCryptFS because my home is encrypted:

$ cat /proc/mounts

/home/cdot/.Private /home/cdot ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=<snip>,ecryptfs_sig=<snip>,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0 gvfsd-fuse /run/user/1001/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=1001,group_id=1001 0 0

But so far I can't find where the mount options eCryptFS is using were set, or how to change them. So that brings me back to the original questions: Where can I set this, and (bonus) is the nosuid option just precautionary or will removing it break eCryptFS?

Thanks in advance for any details.

  • Can you please describe your exact eCryptFS setup? Which folders are mounted where on what occasion? – David Foerster Mar 2 '15 at 12:19
  • Thanks @DavidFoerster, I've added the /proc/mounts output - this is the encrypted home setup that you can enabled out-of-the-box on Ubuntu. – C. Andrew Warren Mar 3 '15 at 3:39
  • @C.AndrewWarren you should not try to remove nosuid, this option was added because of a possible privilege escalation, see CVE-2012-3409 for more Details – Murmel Nov 15 '15 at 20:18

I ran in to this problem building LinuxCNC to run on Ubuntu 18.04; the LinuxCNC code uses setuid root binaries to talk to the PREEMPT RT kernel extensions and specifically disallows execution as root. I built the code in my ecryptfs home directory and the LinuxCNC code did not have a useful error message but I eventually tracked it down to the 'nosuid' mount option ecryptfs adds.

My (temporary) workaround is to perform a run-time modification of the mount. This will not persist across reboots but has allowed me to test the application and it may be useful to others.

sudo mount -i -o remount,suid $HOME

Other than the security implications I do not expect the operation of the ecryptfs filesystem will be impacted.


You can modify the mount point in /etc/fstab. Ensure that whichever mount point you choose exists and has appropriate permissions.

  • Thanks Nolan, unfortunately the current mount options aren't showing up in /etc/fstab - I've added more output above with details. I think this is a VFS being mounted at boot-time by eCryptFS. – C. Andrew Warren Mar 3 '15 at 3:41
  • The current mount options should be shown by the 'mount' command. – lord_nimon Jun 10 '20 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.