mediumfilesystemverified ✓rollback-safe

Ensure nosuid option on /boot/efi partition

mount-boot-efi-nosuid · RHEL ≥ 8 · 1 impl

Description

The nosuid mount option must be set on the /boot/efi partition to prevent setuid programs from being executed from the EFI System Partition.

Rationale

The /boot/efi partition contains EFI boot loader files. Preventing setuid execution on /boot/efi reduces the attack surface by ensuring no setuid programs can be run from the EFI filesystem.

Check → Remediate

Checkcommand

[ -d /sys/firmware/efi ] || { echo "NOT APPLICABLE: system is BIOS (no EFI)"; exit 0; }
findmnt --kernel /boot/efi >/dev/null 2>&1 || { echo "NOT APPLICABLE: /boot/efi not mounted"; exit 0; }
opts=$(findmnt --kernel -n -o OPTIONS /boot/efi 2>/dev/null)
case ",$opts," in *,nosuid,*) echo "OK: /boot/efi has nosuid"; exit 0 ;; esac
echo "FAIL: /boot/efi missing nosuid (opts: $opts)"; exit 1

expected_exit:: 0

Remediatemount_option_set

mount_point:: /boot/efi
options:: nosuid

Framework references

STIG

V-281234 / RHEL-10-700130V-257862 / RHEL-09-231105V-244530

NIST 800-53

CM-6AC-6

Live verification

rhel8:check

#mount#boot-efi#nosuid#hardening