Mountovat home adresar jako noexec (/home type ext3 (rw,noexecerrors=remount-ro))
Mountovat /var/tmp na /tmp - (mount -o bind,noexec,nodev /var/tmp /tmp)
Mountovat /tmp a /dev/shm s parametrem noexec,nodev,nosuid
Mountovat vsechny filesystemy s parametrm noatime (setri diskove zapisy)