Add nodev Option to /boot
Mounts the /boot partition with the nodev option, so the kernel refuses to interpret any device special file placed on it.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Legitimate device nodes belong only in /dev. If /boot is mounted without nodev, an attacker who can write there could plant a malicious character or block device file (for example a raw-disk node) and use it to bypass access controls and reach kernel memory or storage directly. The nodev option makes the kernel ignore device files on that mount, removing this escalation and information-disclosure vector with no functional downside for a boot partition.
What Pavois checks
Pavois inspects the effective mount through InSpec's mount('/boot') resource, reading the live kernel mount table (as findmnt//proc/mounts do). This shows how /boot is actually mounted at this moment, capturing runtime remounts and overrides that a check of /etc/fstab alone could miss.
describe mount('/boot') do
its('options') { should include 'nodev' }
end
describe command("{ findmnt --fstab -no OPTIONS /boot 2>/dev/null; grep -hsE '[[:space:]]/boot[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /boot 2>/dev/null) 2>/dev/null; } | grep -ow 'nodev'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /boot (or mount | grep ' /boot '). The expected output lists nodev among the mount options. Ensure the option is also present in the /boot line of /etc/fstab so it persists across reboots.
Inspect & investigate
There is no dedicated event log; confirm the live state with findmnt /boot. Mount and remount operations appear in journalctl -k / dmesg, and the persistent definition is in /etc/fstab.
Remediation
No automated harden plan is defined, so this must be applied manually: add nodev to the /boot entry options in /etc/fstab, then apply it live with mount -o remount /boot (or reboot). Verify with findmnt /boot.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/boot -v o=nodev '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /boot && mount -o remount,nodev /boot || true |
|---|---|
| name | mount-boot-nodev |
| not_if | awk -v m=/boot '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx nodev |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This is a low-risk change: /boot holds kernels, initramfs images and bootloader files, never device nodes, so nodev has no functional effect on normal operation or booting. Note that /boot must exist as a separate mount for this to apply; if it is part of the root filesystem, create the option on the appropriate entry. As always, edit /etc/fstab carefully and test with mount -a before rebooting to avoid a boot-time mount failure.