In this lesson, you will learn how to reduce your system’s attack surface by remounting non-essential directories as read-only at runtime.
Why Read-Only?
Even with strict mandatory access controls, a compromised process often seeks to leave a "digital footprint" by modifying system binaries or configuration files. By mounting directories like /usr, /bin, or /boot as read-only, you enforce a state where the kernel physically rejects any write operations to these paths, regardless of user privileges. This effectively neutralizes entire classes of malware that rely on modifying system files to achieve persistence or escalate privileges.
Applying Runtime Hardening
While most systems mount these partitions as read-only at boot via /etc/fstab, you can strengthen your security posture by remounting them dynamically if they were accidentally left in read-write mode. This is particularly useful in environments where you want to lock down the system after services have initialized but before untrusted user tasks begin.
To remount a directory as read-only at runtime, you use the mount command with the -o remount,ro flags. For example, to secure the /usr directory:
# Remount /usr as read-only
sudo mount -o remount,ro /usr
Once this command executes, any attempt to create a file or modify an existing one within that directory will trigger an Operation not permitted error. You can verify the change by inspecting the mount table:
mount | grep " /usr "
You should see (ro,...) in the output, confirming that the filesystem is now protected.
Strategic Considerations
It is important to remember that this technique is a powerful hardening layer, not a replacement for good hygiene. If a system process requires legitimate updates to these directories—such as a package manager—you must explicitly remount the partition to read-write mode (rw) temporarily. By keeping these directories read-only by default, you ensure that even if an attacker gains root access, they cannot easily install backdoors or overwrite core system utilities without triggering an audible change in the system’s configuration state.
Key Takeaway: By remounting non-essential system directories as read-only, you create a rigid boundary that prevents unauthorized modification of critical binaries and configurations at the kernel level.