Detections
Analytics

1.301 RHEL-10-700120

Information

RHEL 10 must mount "/boot" with the "nodev" option.

GROUP ID: V-281232RULE ID: SV-281232r1166648

The only legitimate location for device files is the "/dev" directory located on the root partition. The only exception to this is chroot jails.

Solution

Configure RHEL 10 to mount "/boot" with the "nodev" option.

Modify "/etc/fstab" to use the "nodev" option on the "/boot" directory.

To reload all implicit mount units and update the dependency graph so that new options will apply correctly at next remount, run the following command:

$ sudo systemctl daemon-reload

Use the following command to apply the changes immediately without a reboot:

$ sudo mount -o remount /boot

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7(2), CAT|II, CCI|CCI-001764, Rule-ID|SV-281232r1166648_rule, STIG-ID|RHEL-10-700120, Vuln-ID|V-281232

Plugin: Unix

Control ID: 8ca1d9a5b8c02f85b2e13191014097e728944f2a10e7385eb3503b8053357e42