# Ensure nosuid option set on /var/log/audit partition

The 'nosuid' mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) bits from taking effect on executables residing on that filesystem. SUID/SGID bits allow users to execute a file with the permissions of the file's owner or group, which is a common mechanism for privilege escalation. By setting the 'nosuid' option on the /var/log/audit partition, the system mitigates the risk of an attacker placing a malicious SUID/SGID executable in this directory to gain elevated privileges. Since the audit log partition should not contain any legitimate SUID programs, enabling this option is a crucial defense-in-depth measure. The audit script verifies the current mount options for the specified partition, while the remediation script modifies '/etc/fstab' to persistently enforce this setting. The Basic, Moderate, and Strict recommendations are all 'enabled' because this is a binary security control; it is either securely configured (enabled) or it is not. There is no intermediate state, and disabling it offers no security benefit on a data partition like /var/log/audit.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the mount options for the partition hosting the '/var/log/audit' directory. The script must verify if the 'nosuid' option is set for this partition. If the option is set, the script must return the string 'enabled'. If the option is not set, it must return 'disabled'. If '/var/log/audit' does not have its own dedicated partition, the script must return 'not_applicable'. The script's output must consist solely of one of these three strings.

## Remediation Script Working

Bash script that accepts a single positional argument, which should be 'enabled'. If the argument is 'enabled', the script must locate the '/var/log/audit' mount point in '/etc/fstab', add the 'nosuid' option to its entry if it's not already present, and then remount the filesystem to apply the change. The script must return 'true' upon successful modification and remount, and 'false' on failure or if '/var/log/audit' is not a separate partition. The script should perform no action and return 'false' for any argument other than 'enabled'.

