Partitions and Mount Options

Is a partition scheme like the one shown here a sensible security measure for desktops? https://wiki.gentoo.org/wiki/Filesystem/Security#Mount_options # <fs> <mountpoint> <type> <opts> <dump/pass> /dev/sda1 /boot ext4 noauto,nouser,noatime,ro 1 2 /dev/sda3 / ext4 noatime,nouser,ro 0 1 /dev/sda2 none swap sw 0 0 /dev/sda5 /usr ext4 nodev,nouser,noatime,ro 0 3 /dev/sda6 /opt ext4 nodev,nouser,noatime,ro 0 3 /dev/sda7 /var ext4 nodev,nouser,noexec 0 3 /dev/sda8 /tmp ext4 nodev,nouser,noatime,noexec 0 3 /dev/sda9 /var/tmp ext4 nodev,nouser,noatime 0 3 /dev/sda10 /var/cache/distfiles ext4 nodev,nouser,noatime 0 3 /dev/sda11 /var/cache/binpkgs ext4 nodev,nouser,noatime,noexec 0 3 /dev/sda12 /home ext4 nodev,nouser,noatime,noexec 0 3 /dev/md0 /srv ext4 nodev,nouser,noatime,noexec 0 3 Do those mount options increase security significantly enough to make a setup like that worth the trouble? What if it's not physical partitions but LVM instead?

when combined with other security measures, these options can be quite helpful. Generally if you make it impossible to run software off partitions that don't need it, you're reducing the attack space.

LVM+LUKS

>>10718 Isn't that sort of setup intended for system administrators? What will you really get from doing this?

Your fine granularity might help with backups

>>10786 mostly this but security from WHAT or WHOM? that is the better question decreasing the possibility of attack vectors is a fair path to take if your general strategy is to play defense. Are you seeking to defend for the sake of redundancy or what? As >>10721 states, the less att space you give off, the better, but that also means that you must focus on the implicit or explicit vulnerabilities that are created or engendered by the space that you are leaving out on the open or atleast be able to be executed upon. LVM is not a bad idea though