mediumfilesystemunverified
Ensure the nodev option is set on the /boot partition
mount-boot-nodev · RHEL ≥ 8 · 1 impl
Description
If /boot is a separate partition it must be mounted with nodev so device files cannot be created there.
Rationale
Device files on /boot could be used to access block devices directly, bypassing filesystem controls.
Check → Remediate
Checkcommand
findmnt --kernel /boot >/dev/null 2>&1 || { echo "NOT APPLICABLE: /boot not a separate mount"; exit 0; }
opts=$(findmnt --kernel -n -o OPTIONS /boot 2>/dev/null)
case ",$opts," in *,nodev,*) echo "OK: /boot has nodev"; exit 0 ;; esac
echo "FAIL: /boot missing nodev (opts: $opts)"; exit 1
- expected_exit:
- 0
Remediatemount_option_set
- mount_point:
- /boot
- options:
- nodev
Framework references
STIG
V-281232 / RHEL-10-700120V-257860 / RHEL-09-231095
NIST 800-53
CM-6AC-6
#mount#boot#nodev#stig