Ensure That Partitions Requiring No Modification Are Mounted as Read-Only

Mounting a filesystem that does not require data modification in read-only mode can prevent unintentional or malicious data tampering and reduce the attack surface.

1. Run the mount command to check whether the mounted filesystems meet the requirements. For example, to check whether the /root/readonly directory is mounted in read-only mode, run the following command:

   mount | grep "\/root\/readonly" | grep "\<ro\>" 

   The following information is displayed. If no data is returned, the directory is either not mounted or not mounted in read-only mode.

   /dev/vda on /root/readonly type ext4 (ro,relatime,seclabel)

2. Unmount the corresponding mount point and mount it again as read-only:

   umount /root/readonly
   mount -o ro /dev/vda /root/readonly/

3. If the hard disk or partition is mounted via the /etc/fstab configuration file, you can modify this file to add the ro mount option for the specified mount point.
   1. Open the configuration file.

      vim /etc/fstab

   2. Press i to enter the insert mode. Add the ro mount option for the specified mount point in the following format based on your actual requirements:

      /dev/vda /root/readonly ext4 ro 0 0

   3. Press Esc to exit the insert mode. Type :wq! and press Enter to save the file and exit.