Summary
In this chapter, we looked at two ways to prevent untrusted programs from running on your systems. The first method, which can be used on any Linux distro, is to separate the various system and data directories into their own separate partitions, and then to mount each of these partitions with the appropriate combination of the noexec, nosuid, and nodev options. The second method, which so far is only available on Red Hat and its clones, is to use the fapolicyd framework. We saw how to automatically enable both of these methods by applying the STIG OpenSCAP profile as we install the operating system. Finally, we saw how to install fapolicyd separately, without having to apply the STIG profile.
In the next chapter, we’ll be wrapping things up with a quick look at various topics that didn’t neatly fit into any of the preceding chapters. I’ll see you there.
