# Ensure nosuid option set on /var/log/audit partition

Necessity: The 'nosuid' mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) bits from taking effect on a filesystem. The '/var/log/audit' partition is designated for storing audit logs and should not contain executable binaries, particularly those with elevated privileges. If an attacker gains write access to this partition, they could place a malicious SUID binary. Without the 'nosuid' flag, this binary could be executed by another user, allowing the attacker to escalate privileges to the file's owner (often root). Enforcing this option is a critical defense-in-depth measure against privilege escalation attacks.

Auditing and Remediation: The audit script inspects the system's mount configuration to confirm that '/var/log/audit' is a distinct partition and that it is mounted with the 'nosuid' option. The remediation script edits the system's static filesystem table ('/etc/fstab') to permanently add the 'nosuid' option for the '/var/log/audit' partition and then applies the change to the active session by remounting it.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'enabled'. This is a foundational security setting with no legitimate operational downside or performance impact. The protection it offers against a common privilege escalation vector is absolute and non-negotiable in any secure environment. There is no valid intermediate or 'moderate' state; the partition is either protected from this threat ('enabled') or it is not. Therefore, the most secure configuration is recommended for all levels of hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/var/log/audit' mount point has the 'nosuid' option set. The script must first verify that '/var/log/audit' is a separate partition. If it is not configured as a separate partition, the script must output the string 'not_configured'. If it is a partition but the 'nosuid' option is not present, it must output 'disabled'. If the partition exists and the 'nosuid' option is set, it must output 'enabled'. The script's output must consist solely of one of these three strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'enabled'. The script should modify the '/etc/fstab' file to add the 'nosuid' option to the mount entry for the '/var/log/audit' partition. If the option is already present, no change is necessary. After successfully updating '/etc/fstab', the script must remount the partition to apply the setting. The script must return the boolean value 'true' on success and 'false' if it fails, for example, if '/var/log/audit' is not a dedicated partition or if the remount operation is unsuccessful.

