Add noexec Option to /boot
Mounts the /boot partition with the noexec option so no binary can be executed from it.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /boot partition holds the kernel, initramfs and bootloader files. Once the boot process has finished, no program should ever be executed from this partition. Mounting it with noexec removes a staging area an attacker could use to run binaries, and reduces the attack surface against the boot chain.
What Pavois checks
Pavois reads the effective mount table via mount('/boot') and asserts that the resolved option list contains noexec. This reflects how the kernel actually mounted the filesystem right now, including options injected by systemd mount units or remounts, whereas parsing /etc/fstab alone would miss a partition that was remounted with different options or mounted by a generator. If /boot is not a separate mount point, the control has no separate partition to harden.
describe mount('/boot') do
its('options') { should include 'noexec' }
end
describe command("{ findmnt --fstab -no OPTIONS /boot 2>/dev/null; grep -hsE '[[:space:]]/boot[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /boot 2>/dev/null) 2>/dev/null; } | grep -ow 'noexec'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /boot (or findmnt -no OPTIONS /boot) and confirm noexec appears in the option list, e.g. rw,nosuid,nodev,noexec,relatime. You can also check mount | grep ' /boot '.
Inspect & investigate
Use findmnt /boot to see the live mount options. Attempts to run a binary from a noexec mount fail with Permission denied and are visible in shell output; if auditd is configured, related EXECVE denials may appear in /var/log/audit/audit.log.
Remediation
This rule has no automated harden plan: it must be applied manually. Add noexec to the /boot line in /etc/fstab (e.g. options defaults,nosuid,nodev,noexec), then mount -o remount /boot to apply it without rebooting. Verify with findmnt /boot before considering it done.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/boot -v o=noexec '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /boot && mount -o remount,noexec /boot || true |
|---|---|
| name | mount-boot-noexec |
| not_if | awk -v m=/boot '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx noexec |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without noexec, an attacker who can write to /boot could stage and run executables from it. Risks before applying are low for /boot: it normally holds only kernel images and no programs. Precautions: ensure kernel/bootloader update tooling (e.g. grub-mkconfig, update-initramfs, kernel-install) does not need to execute helper scripts directly from /boot, on standard distributions it does not. If /boot is not a separate partition, do not add the option to / blindly, as noexec on the root filesystem would break the system.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.