# In /etc/sysctl.conf kernel lockdown=integrity
This prevents even root from remounting filesystems with weaker security flags in certain configurations.
Most organizations have that monitor network traffic and file hashes. However, mount parameter modifications exist in a blind spot because:
The physical bits on the disk are stored in "plain text." If someone gains access to the underlying storage hardware or a snapshot of the volume, they can read your data without needing a cryptographic key.
Here is a deep dive into what this means, why it happens, and how to fix it. What Does This Keyword Mean?