# Ensure nodev option set on /home partition

Necessity: Setting the 'nodev' (no devices) mount option on a separate /home partition is a critical security measure. It prevents the interpretation of character or block special devices from within that filesystem. Without this option, an attacker who gains user-level access could create a malicious device file (e.g., a device that points to a raw disk partition) in their home directory. They could then use this device file to attempt privilege escalation, access sensitive data, or cause a denial-of-service. By disallowing device files on /home, this entire attack vector is mitigated. Auditing and Remediation: The audit script directly queries the system's current mount information for the /home partition to verify if the 'nodev' option is active. The remediation script modifies the system's static filesystem configuration file (/etc/fstab) to ensure the setting is applied persistently across reboots, and then remounts the partition to enforce the change immediately. Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Enabled' because this is a fundamental, binary security control. Basic: Setting 'nodev' is a baseline requirement for securing user-writable partitions, as recommended by security benchmarks like CIS. Moderate: There is no less-secure-but-acceptable alternative. The control is either correctly implemented ('Enabled') or it is not. Strict: The most secure posture is to have this option enabled. Any deviation from this standard introduces unnecessary risk. If a separate /home partition does not exist, the control is 'Not Applicable', though creating one is itself a security best practice.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'nodev' option is set for the '/home' mount point. The script should use the 'findmnt' command to inspect the currently mounted filesystem options. If a separate '/home' partition exists and the 'nodev' option is present in its mount options, the script must return the string 'Enabled'. If the partition exists but 'nodev' is not set, it must return 'Disabled'. If a separate '/home' partition does not exist, the script must return 'Not Applicable'. The output should contain only one of these three strings, with no additional text or formatting.

## Remediation Script Working

Bash script that takes a single positional argument ('Enabled'). If the argument is 'Enabled', the script must ensure the 'nodev' option is set for the '/home' partition in '/etc/fstab'. The script should idempotently add 'nodev' to the list of mount options for '/home'. After updating '/etc/fstab', it must attempt to remount '/home' to apply the change immediately. If a separate '/home' partition is not configured in '/etc/fstab', the script should take no action and return 'false'. The script must return 'true' upon successful modification and remount, and 'false' otherwise.

