# Ensure nodev option set on /var/log partition

Necessity: The 'nodev' mount option prevents character and block special devices from being created or interpreted on a given filesystem. The /var/log directory is a common target for attackers as it is often writable by various services. If an attacker gains write access, they could create a malicious device file (e.g., a pseudo-device pointing to a hard drive) in /var/log. A privileged user or process could then be tricked into accessing this file, potentially leading to privilege escalation, data exfiltration, or system compromise. Enforcing 'nodev' on the /var/log partition completely mitigates this specific threat vector. Auditing and Remediation: The audit script verifies the live system configuration by checking the mount options currently applied to the /var/log partition. The remediation script modifies the persistent filesystem configuration in '/etc/fstab' to ensure the 'nodev' option is present and then attempts to apply this change to the running system by remounting the partition. Recommended State Rationale: The recommended state is consistently 'Enabled' across all security levels (Basic, Moderate, Strict). This is a binary security control with no middle ground; it is either secure (Enabled) or insecure (Disabled). The risk of allowing device file interpretation in a log directory far outweighs any operational reason to disable it. Therefore, security benchmarks like CIS mandate this setting as a fundamental hardening measure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/var/log' partition is mounted with the 'nodev' option. The script should use the 'findmnt' command to inspect the currently active mount options for '/var/log'. It must output 'Enabled' if the 'nodev' option is present and 'Disabled' if it is not. The output must contain only this string value and no other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the 'nodev' option to the '/var/log' entry in '/etc/fstab'. If the argument is 'Disabled', it must remove the option. The script must handle cases where the option is already present or absent to avoid duplicates or errors. After modifying '/etc/fstab', it must remount the partition using 'mount -o remount /var/log' to apply the change. The script must output 'true' on success and 'false' on failure.

