On SELinux enabled systems, every object (processes, files, etc) has a security label. SELinux policy contains the rules which describe permitted operations for those labels. The default policy is quite complex and extensive. Configuring the policy might already be enough to prevent mounting on most locations (based by label).
The policy does not place restrictions on unconfined users. Additionally
allow_mount_anyfile boolean controls if
mount command can use (almost) any file as a mount point. Using confined users will place many limits on how users can access the system. SELinux Role Based Access Control (RBAC) places confined user in a confined role. Roles limit which domains (process security labels) are allowed for the role. Also, a confined user in
user_r can not switch to another role.
We can inspect the installed policy to determine if it is possible for an user in confined role to use a labeled file/directory as a mountpoint (directly or by abusing another allowed domain).
First, to check what domains
user_r can transition into with
seinfo -r user_t -x
SELinux policy language has
mounton permission which allows a domain to use the target file/directory as mount point. To query the installed policy to find domains are allowed to use the target object as mount point:
sesearch --allow -t <target file/directory type> -p mounton
If there is no rules with a domain that
user_r is allowed to, a user in
user_r can not use the target as mount point (even if they were root in
user_r). Additionally one should verify there are no
relabelfrom (relabeling) or
unlink permissions which could be used to circumvent the policy.
Restricting administrator (root in
sysadm_r) is not trivial. It requires either a policy module with a new custom type and/or customizing the base policy, as
sysadm_t likely has the permissions mentioned before. The customized policy needs to have type which is accessible only to the allowed domains. Additionally the policy needs to deny anything which might allow circumventing the policy, resulting in a root user which is somewhat closer to confined user than root user.