From f37a43fab076b7f061f8a8ba55b80690904c7b6b Mon Sep 17 00:00:00 2001
From: Denis Chevalier <perso@denischevalier.fr>
Date: Thu, 6 Aug 2026 12:41:37 +0200
Subject: Hardened mount options

---
 etc.bash  | 2 ++
 etc/fstab | 7 +++++++
 2 files changed, 9 insertions(+)
 create mode 100644 etc/fstab

diff --git a/etc.bash b/etc.bash
index 14b41b7..77fb690 100755
--- a/etc.bash
+++ b/etc.bash
@@ -12,6 +12,8 @@ sudo cp -v etc/systemd/coredump.conf /etc/systemd/
 sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d/
 sudo sysctl --system
 
+grep tmpfs /etc/fstab || sudo cat etc/fstab >> /etc/fstab
+
 # firewall
 sudo ufw default deny incoming
 sudo ufw default allow outgoing
diff --git a/etc/fstab b/etc/fstab
new file mode 100644
index 0000000..9cdf203
--- /dev/null
+++ b/etc/fstab
@@ -0,0 +1,7 @@
+
+# Restrict shared memory
+tmpfs  /dev/shm  tmpfs  defaults,nodev,nosuid,noexec 0 0
+
+# Restrict /tmp (keep noexec off to allow dev strict directly run out of /tmp)
+tmpfs  /tmp  tmpfs  defaults,nodev,nosuid  0 0
+
-- 
cgit