Add nosuid Option to /boot
Mounts the /boot partition with the nosuid option so setuid/setgid bits on its files are ignored.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The presence of SUID and SGID executables must be tightly controlled, because they run with the privileges of their owner (often root). The /boot partition should never legitimately host such binaries. Mounting it with nosuid makes the kernel ignore the setuid/setgid bits on any file there, so a planted SUID-root binary cannot be used to escalate privileges.
What Pavois checks
Pavois reads the effective mount table via mount('/boot') and asserts the resolved option list contains nosuid. This captures the live kernel state, including options applied by systemd mount units or a later remount, which a static read of /etc/fstab would miss. If /boot is not a separate mount point, there is no dedicated partition to harden.
describe mount('/boot') do
its('options') { should include 'nosuid' }
end
describe command("{ findmnt --fstab -no OPTIONS /boot 2>/dev/null; grep -hsE '[[:space:]]/boot[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /boot 2>/dev/null) 2>/dev/null; } | grep -ow 'nosuid'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /boot (or findmnt -no OPTIONS /boot) and confirm nosuid is present, e.g. rw,nosuid,nodev,noexec,relatime.
Inspect & investigate
Use findmnt /boot to inspect the active options. There is no dedicated log line, but a SUID binary executed from a nosuid mount simply runs without elevated privileges; auditd EXECVE/SYSCALL records in /var/log/audit/audit.log can corroborate execution attempts.
Remediation
This rule has no automated harden plan: apply it manually. Add nosuid to the /boot line in /etc/fstab (e.g. defaults,nosuid,nodev,noexec), then mount -o remount /boot to apply without rebooting, and confirm with findmnt /boot.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/boot -v o=nosuid '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /boot && mount -o remount,nosuid /boot || true |
|---|---|
| name | mount-boot-nosuid |
| not_if | awk -v m=/boot '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx nosuid |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without nosuid, a SUID-root binary placed on /boot could be leveraged for privilege escalation. The change is safe in practice: /boot legitimately contains no SUID programs. Precautions: if /boot is not a separate partition, do not apply nosuid to /, the root filesystem hosts essential SUID binaries (e.g. sudo, su, passwd) and nosuid there would break authentication and privilege escalation.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
| NIST | AC-6, AC-6(1), CM-6(a), CM-7(a), CM-7(b), MP-7 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.