mediumfilesystemverified ✓

Ensure noexec option on removable media

mount-removable-noexec · RHEL ≥ 8 · 1 impl

Description

The noexec mount option must be set on all removable media filesystems to prevent execution of programs directly from removable storage.

Rationale

Removable media may contain malicious executables. The noexec option prevents running programs directly from removable media, reducing the risk of malware execution from untrusted storage devices.

Check → Remediate

Checkcommand

grep -E ' /(media|mnt|run/media)' /proc/mounts 2>/dev/null | grep -v noexec | head -1

Remediatemanual

note:: Add the noexec option to all removable media mount points in /etc/fstab. For automounted media, configure udev rules or autofs to include noexec.

Framework references

STIG

V-257857 / RHEL-09-231080V-230304

NIST 800-53

CM-6AC-3

Live verification

rhel8:checkrhel9:check

#mount#removable-media#noexec#hardening