Audit a mount point for missing noexec/nosuid

Converts the classic `mount` command's unstructured output into JSON with jc, then jq-checks a mount point for the hardening flags most hosts forget. The same jc-to-jq bridge works for any of jc's 200+ command parsers (ps, dig, ss, df), not just mount.

$ mount | jc --mount \
  | jq '.[] | select(.mount_point=="/dev") | {mount_point, type, noexec: (.options | contains(["noexec"])), nosuid: (.options | contains(["nosuid"]))}'

1. [01] mountmount
   Lists every mounted filesystem with its options, in the ad-hoc text format unix has used for decades.
2. [02] jcjc --mount
   jc recognizes `mount`'s output format and converts it to a JSON array of {filesystem, mount_point, type, options}. Swap --mount for --ps, --dig, --ss, --df, etc. to parse 200+ other classic commands the same way.
3. [03] jqjq '.[] | select(.mount_point=="/dev") | {mount_point, type, noexec: (.options |…
   Picks the mount point to audit and reports whether the noexec/nosuid hardening flags are set — the check every CIS benchmark asks for on /tmp, /dev/shm, and friends, now scriptable instead of eyeballed.

{
  "mount_point": "/dev",
  "type": "devtmpfs",
  "noexec": false,
  "nosuid": false
}

• Captured on Ubuntu 24.04 (jc 1.25.7) auditing /dev in a container — swap the select() target to /tmp, /dev/shm, or /var/tmp for the mounts CIS benchmarks actually flag; a hardened host should show noexec/nosuid: true there.
• jc's `magic` mode (`jc mount` with no pipe, on supported shells) skips typing the command twice — see jc's README for the alias.
• Field names differ per parser (`jc --ps`, `jc --dig`, ...); check `jc --help <parser>` before reusing this pattern on a new command.