Benefits of separating operating system files from user files onto different partitions

Question

I am in the process of hardening a CentOS box, and came across an article that suggested mounting these filesystems onto different partitions:

/usr
/home
/var and /var/tmp
/tmp

I was wondering what exactly this accomplishes, in terms of securing the box?

Answer 1

In a nutshell..

/var is where logs are stored.

/tmp is able to be written to by anyone.

/home is where user data is stored.

/usr is typically where software is installed.

If these locations were stored on a single filesystem, that filesystem could be fully utilized. If / were full, it could potentially prevent the system from operating properly.

Additionally, separate filesystems can be mounted with different settings. For example, I like to mount /tmp with noexec and nosuid. If an application were compromised and had files written to /tmp, not being able to execute files would distinctly limit the ability to further compromise the system.

I would recommend reading more about the Filesystem Hierarchy Standard to better understand those locations, as my description is summarized and not complete.

• Filesystem Hierarchy Standard
• HIER(7)
• MOUNT(8)