In this lesson, you will learn how to use mount-level flags to transform parts of your root filesystem into read-only zones, effectively locking down critical system binaries against unauthorized tampering.
The Power of Mount Options
In a standard Linux setup, the root filesystem is typically mounted with read-write permissions, which is necessary for logs and temporary files. However, directories containing your core binaries—such as /bin, /sbin, /usr, and /lib—rarely need to be modified after the system has booted. By adjusting how these partitions or directories are mounted, we can prevent even a compromised process from overwriting these files, effectively hardening the system against "rootkit" style modifications.
Applying Read-Only Mounts
The most effective way to harden your system is to use the mount command with the -o ro (read-only) flag. When a directory is mounted with this flag, the kernel will reject any attempt to write, delete, or modify files within that path.
If you have dedicated partitions for critical system areas, you can enforce this at the mount point:
# Remount the /usr partition as read-only
sudo mount -o remount,ro /usr
If you do not have separate partitions, you can use a "bind mount" to apply these restrictions. For example, if you want to protect your binaries, you can bind-mount them with the read-only flag:
# Create a read-only bind mount for /bin
sudo mount --bind /bin /bin
sudo mount -o remount,ro,bind /bin
Why This Matters
By forcing these directories into a read-only state, you create a "known good" baseline. Even if an attacker gains high-level privileges, they cannot inject malicious code into your binaries or replace system utilities with compromised versions. Because the kernel enforces these restrictions at the filesystem driver level, it provides a robust defense that persists regardless of how a user or process attempts to bypass it.
When you need to perform system updates, you simply remount the target as read-write (remount,rw), apply your changes, and flip it back to read-only.
Key Takeaway: Applying ro (read-only) mount flags to critical system directories acts as an immutable shield, preventing unauthorized modification of the core binaries that keep your Linux system secure.