CME-501

Read-Only Root Filesystem

Isolate OS/Kernel Unquantified evidence Preventive

Description

Mounts root filesystem as read-only, preventing persistent modification of system binaries, libraries, and configuration. Writable areas are confined to specific tmpfs or overlay mounts.

CVSS Vector Impacts

Metric	Transition	Rationale
Integrity (I)	H → L	Cannot persistently modify system files even with root access
Availability (A)	H → L	System recovers original state on reboot

CWE Relationships

CWE-284

Verification

Check mount options for root filesystem

$ mount | grep 'on / ' | grep 'ro,'
# Expected: ro,

Platform: linux

Remediation

linux systemd ProtectSystem=strict drop-in for per-service read-only root


mkdir -p /etc/systemd/system/<service>.service.d
printf '[Service]\nProtectSystem=strict\nReadWritePaths=<writable_paths>\n' > /etc/systemd/system/<service>.service.d/readonly-root.conf
systemctl daemon-reload
systemctl restart <service>

kubernetes Kubernetes readOnlyRootFilesystem securityContext


kubectl patch deployment <deployment> -n <namespace> --type=json -p '[{"op":"add","path":"/spec/template/spec/containers/0/securityContext/readOnlyRootFilesystem","value":true}]'
kubectl patch deployment <deployment> -n <namespace> --type=json -p '[{"op":"add","path":"/spec/template/spec/volumes/-","value":{"name":"tmp","emptyDir":{}}},{"op":"add","path":"/spec/template/spec/containers/0/volumeMounts/-","value":{"name":"tmp","mountPath":"/tmp"}}]'