mediumfilesystemverified ✓

Ensure nodev option on removable media

mount-removable-nodev · RHEL ≥ 8 · 1 impl

Description

The nodev mount option must be set on all removable media filesystems to prevent device files from being created or used on removable storage.

Rationale

Removable media could contain device files that allow bypass of access controls. The nodev option prevents interpretation of device special files on removable media, reducing the risk of privilege escalation.

Check → Remediate

Checkcommand

grep -E ' /(media|mnt|run/media)' /proc/mounts 2>/dev/null | grep -v nodev | head -1

Remediatemanual

note:: Add the nodev option to all removable media mount points in /etc/fstab. For automounted media, configure udev rules or autofs to include nodev.

Framework references

STIG

V-257858 / RHEL-09-231085V-230303

NIST 800-53

CM-6AC-3

Live verification

rhel8:checkrhel9:check

#mount#removable-media#nodev#hardening