{
  fileSystems."/".options = ["noexec"];
  fileSystems."/home".options = ["noexec"];
  fileSystems."/boot".options = ["noexec"];
}