# Ensure nosuid option set on /var partition

Necessity: The `nosuid` mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) bits from taking effect on a filesystem. The /var directory is intended for variable data like logs, spool files, and caches, and should not contain executable binaries, especially those with elevated privileges. If an attacker gains write access to a directory within /var, they could place a malicious SUID executable there. Without the `nosuid` flag, they could run this executable to escalate their privileges to that of the file's owner (often root). Setting this option is a critical defense-in-depth measure against local privilege escalation. Auditing and Remediation: The audit script directly queries the kernel's view of the mounted filesystems to verify if the `nosuid` option is active for /var. The remediation script makes this setting persistent by modifying `/etc/fstab`, the static filesystem configuration file, and then remounts the partition to apply the change without requiring a system reboot. Recommended State Rationale: A state of 'enabled' is recommended for all security levels (Basic, Moderate, and Strict). This is a foundational security hardening practice with no legitimate functional reason to be disabled on a data partition like /var. There is no performance impact. Because the risk of privilege escalation is significant and the mitigation is simple and non-disruptive, this setting is considered a mandatory baseline for any securely configured system, as recommended by security frameworks like the CIS Benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that inspects the mount options for the /var partition. The script must use the `findmnt` command to query the live mount configuration. It should parse the output to determine if the `nosuid` option is set. The script must return only the string 'enabled' if the option is present, or 'disabled' if it is not. No other text or formatting should be included in the output.

## Remediation Script Working

shell script that accepts a single positional argument, which must be the string 'enabled'. The script must ensure the `nosuid` option is configured for the /var partition. It should first verify that /var is a separate mount point. If so, it must idempotently add the `nosuid` option to the appropriate line in `/etc/fstab`. After updating the file, it must execute `mount -o remount /var` to apply the setting immediately. The script must return the string 'true' on success and 'false' on failure (e.g., if /var is not a separate partition).

