/dev/shm and /tmp each have the nodev, nosuid, and noexec mount options

RHEL8 also check /var/log /var/log/audit /var/tmp, these are not separate mounts by default. Also, kube only supports 2 additional mounts, so what makes the most sense /var/log and /var/tmp?

Finally fapolicyd is not included or supported. Are there other mitigations that we can point to?