grsecurity forums

ok, now I know remounts can't be done inside root jails

But they can be done outside a jail. Is there any way I can mount a filesystem in RO and totally forbid, ban, disallow, anbody from remounting it?

thanks
ernesto

If you mean keeping anyone from outside the chroot from remounting it, you need to use the ACL system. CAP_SYS_ADMIN covers mounting, so you'll need to remove this (it's enforced in the default policy).

-Brad