What it means
Filesystem mount hardening uses mount boundaries and options to reduce executable content, device access, privilege transitions, and unsafe write behavior on selected filesystems.
Why it matters
Mount controls can contain several common abuse paths, but they must be selected by workload and tested because applications may rely on behavior the option intentionally blocks.
Practical focus
- Define the filesystems and workloads that can tolerate restrictive mount behavior and the security outcome it must support
- Apply options such as noexec, nodev, nosuid, read-only, and controlled automounting where appropriate through documented, reviewable configuration
- Verify effective mount flags, boot behavior, write requirements, and exception use after changes and on a scheduled basis
- Plan for a restrictive option breaking an application or an fstab error disrupting startup, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a restrictive option breaking an application or an fstab error disrupting startup as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: