Prevent runaway privileged processes from writing to block devices

[raja-grewal]

This pull request prevents processes from writing to block devices that are mounted by filesystems to protect against runaway privileged processes causing filesystem corruption and kernel crashes.

Credit to the kernel-hardening-checker tool for bringing this to my attention.

Note this is also now only possible using Debian 13 and so should be included in our upcoming port.

Changes

Set the bdev_allow_write_mounted=0 kernel boot parameter.

Mandatory Checklist

• Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements:

Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

Optional Checklist

The following items are optional but might be requested in certain cases.

• I have tested it locally
• I have reviewed and updated any documentation if relevant
• I am providing new code and test(s) for it