X-Git-Url: https://gerrit.automotivelinux.org/gerrit/gitweb?a=blobdiff_plain;ds=sidebyside;f=docs%2F2_Architecture_Guides%2F2.2_Security_Blueprint%2F4_Kernel%2F1.2.4.5_FileSystems.md;fp=docs%2F2_Architecture_Guides%2F2.2_Security_Blueprint%2F4_Kernel%2F1.2.4.5_FileSystems.md;h=0000000000000000000000000000000000000000;hb=9cc56459419f1225f5e9851825ad305424b3d6fb;hp=14f8c53bdf7092ad00f0ff9cc9469b5ba744a5ac;hpb=c04ab11b946684902e3e39aef475a2d16c09e1c4;p=AGL%2Fdocumentation.git

diff --git a/docs/2_Architecture_Guides/2.2_Security_Blueprint/4_Kernel/1.2.4.5_FileSystems.md b/docs/2_Architecture_Guides/2.2_Security_Blueprint/4_Kernel/1.2.4.5_FileSystems.md
deleted file mode 100644
index 14f8c53..0000000
--- a/docs/2_Architecture_Guides/2.2_Security_Blueprint/4_Kernel/1.2.4.5_FileSystems.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: File Systems
----
-
-# File System
-
-## Disable all file systems not needed
-
-To reduce the attack surface, file system data is parsed by the kernel, so any
-logic bugs in file system drivers can become kernel exploits.
-
-### Disable NFS file system
-
-NFS FileSystems are useful during development phases, but this can be a very
-helpful way for an attacker to get files when you are in production mode, so we
-must disable them.
-
-<!-- section-config -->
-
-Domain                   | `Config` name   | `Value`
------------------------- | --------------- | -------
-Kernel-FileSystems-NFS-1 | `CONFIG_NFSD`   | `n`
-Kernel-FileSystems-NFS-2 | `CONFIG_NFS_FS` | `n`
-
-<!-- end-section-config -->
-
---------------------------------------------------------------------------------
-
-<!-- pagebreak -->
-
-## Partition Mount Options
-
-There are several security restrictions that can be set on a filesystem when it
-is mounted. Some common security options include, but are not limited to:
-
-`nosuid` - Do not allow set-user-identifier or set-group-identifier bits to take
-effect.
-
-`nodev` - Do not interpret character or block special devices on the filesystem.
-
-`noexec` - Do not allow execution of any binaries on the mounted filesystem.
-
-`ro` - Mount filesystem as read-only.
-
-The following flags shall be used for mounting common filesystems:
-
-<!-- section-config -->
-
-Domain                     | `Partition`         | `Value`
--------------------------- | ------------------- | -----------------------------------------------------------------
-Kernel-FileSystems-Mount-1 | `/boot`             | `nosuid`, `nodev` and `noexec`.
-Kernel-FileSystems-Mount-2 | `/var` & `/tmp`     | In `/etc/fstab` or `vfstab`, add `nosuid`, `nodev` and `noexec`.
-Kernel-FileSystems-Mount-3 | _Non-root local_    | If type is `ext2` or `ext3` and mount point not '/', add `nodev`.
-Kernel-FileSystems-Mount-4 | _Removable storage_ | Add `nosuid`, `nodev` and `noexec`.
-Kernel-FileSystems-Mount-5 | _Temporary storage_ | Add `nosuid`, `nodev` and `noexec`.
-Kernel-FileSystems-Mount-6 | `/dev/shm`          | Add `nosuid`, `nodev` and `noexec`.
-Kernel-FileSystems-Mount-7 | `/dev`              | Add `nosuid` and `noexec`.
-
-<!-- end-section-config --> <!-- section-note -->
-
-If `CONFIG_DEVTMPFS_MOUNT` is set, then the kernel will mount /dev and will not
-apply the `nosuid`, `noexec` options. Either disable `CONFIG_DEVTMPFS_MOUNT` or
-add a remount with `noexec` and `nosuid` options to system startup.
-
-<!-- end-section-note --> <!-- section-config -->
-
-Domain                     | `Config` name           | _State_ or `Value`
--------------------------- | ----------------------- | -----------------------------------------------------------------------
-Kernel-FileSystems-Mount-1 | `CONFIG_DEVTMPFS_MOUNT` | _Disabled_ or add remount with `noexec` and `nosuid` to system startup.
-
-<!-- end-section-config -->