Add nosuid Option to /boot/efi
Mounts the EFI system partition /boot/efi with the nosuid option, so the kernel ignores the setuid/setgid bits on any executable stored there.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The EFI system partition holds bootloader files, not user programs, and should never be a source of privileged binaries. Without nosuid, an attacker who can write a setuid-root binary onto /boot/efi gains a path to privilege escalation. Mounting with nosuid makes the kernel strip the setuid/setgid effect of any file on that partition, closing this escalation vector with no impact on booting.
What Pavois checks
Pavois inspects the effective mount via InSpec's mount('/boot/efi') resource, which reads the live kernel mount table (the same data as findmnt//proc/mounts). This reflects how the filesystem is actually mounted right now, including options applied at runtime, rather than trusting /etc/fstab, which may diverge from the running state.
describe mount('/boot/efi') do
its('options') { should include 'nosuid' }
end
describe command("{ findmnt --fstab -no OPTIONS /boot/efi 2>/dev/null; grep -hsE '[[:space:]]/boot/efi[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /boot/efi 2>/dev/null) 2>/dev/null; } | grep -ow 'nosuid'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /boot/efi (or mount | grep /boot/efi). The expected output lists nosuid among the mount options. Confirm it is also persisted in /etc/fstab so it survives a reboot.
Inspect & investigate
There is no dedicated event log; verify the live state with findmnt /boot/efi. Mount/remount actions are visible in journalctl -k / dmesg, and the persistent definition lives in /etc/fstab.
Remediation
No automated harden plan is defined, so this must be applied manually: add nosuid to the /boot/efi entry options in /etc/fstab, then apply it live with mount -o remount /boot/efi (or reboot). Verify with findmnt /boot/efi.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/boot/efi -v o=nosuid '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /boot/efi && mount -o remount,nosuid /boot/efi || true |
|---|---|
| name | mount-boot-efi-nosuid |
| not_if | awk -v m=/boot/efi '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx nosuid |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This change is low-risk: the EFI partition contains only bootloader binaries that are run by firmware, not by the OS via setuid, so nosuid does not affect booting. The main precaution is editing /etc/fstab carefully, a malformed entry can prevent the system from mounting filesystems at boot. Test the line with mount -a (and findmnt /boot/efi) before rebooting, and keep recovery media handy.