

71·
18 hours agoThe nosuid
mount option disables this behavior per mount. Just be sure you don’t use suid binaries.
Example: sudo
or doas
. I replaced those with switching to a tty with an already open root account on startup. Generally faster and more secure (you need physical access to get to the tty).
From what I’ve read, no. Though it doesn’t solve the fundamental problem of a root process handling untrusted input from a regular user.
The TTY method is IMO better as it ties privileges to a piece of physical hardware, bypassing the complexities of userspace elevation of privileges.