Kernel Hardening - security-misc

Patrick · February 15, 2026, 1:26pm

bdev_allow_write_mounted=0 revert?

Comment by ArrayBolt3 - Prevent runaway privileged processes from writing to block devices

master ← raja-grewal:limit_bdev_writes

@raja-grewal, @adrelanos This option renders it impossible to mount NTFS volumes… at least when using the `mount` command. By default, this uses the ntfs-3g FUSE driver, but this option prevents that driver from working since now a userspace application has to write to a block device the system sees as mounted. This means that if one does `sudo mkfs.ntfs -Q /dev/sda1`, then `sudo mount /dev/sda1 /mnt`, the mount command will fail with a "Device or resource busy" error. Removing this option from the kernel command line configuration resolves the issue. This has also caused problems with zerofree, and telling users how to disable it has proven rather tricky in at least one situation. See https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 and the conversation below. Since this provides no theoretical security enhancements in most situations (as explained above), and runaway root processes are likely rare, I think this should be reverted. Edit: This seems to also be causing some issues with fwupd, with messages like `Feb 12 10:56:36 host fwupd[8963]: 10:56:36.047 FuEngine failed to add device /sys/devices/pci0000:00/0000:00:0d.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1: failed to subclass open: failed to open /dev/sda1: Device or resource busy`.