# Ensure nodev option set on /var/log/audit partition

Necessity: The 'nodev' mount option prevents character and block special devices from being interpreted on a given filesystem. The /var/log/audit partition contains critical security logs. If an attacker gains write access to this partition, they could potentially create a device file (e.g., a raw disk device) to access hardware directly, bypassing standard permissions and escalating privileges. Enforcing the 'nodev' option mitigates this specific attack vector, ensuring that device files on this partition are not functional. Misconfiguration exposes the system to potential privilege escalation attacks. Auditing and Remediation: The audit script checks the live mount settings for the '/var/log/audit' partition to confirm if the 'nodev' option is active. The remediation script modifies the '/etc/fstab' file to ensure the setting is persistent across reboots and then applies the change to the live filesystem by remounting the partition. Recommended State Rationale: Basic: ['Enabled']. This is the minimum recommended state for compliance with security benchmarks like CIS. It provides a fundamental layer of protection for the audit log partition. Moderate: ['Enabled']. As this is a binary security control (either on or off), the moderate state is identical to the basic state. There is no less secure, yet acceptable, configuration. Strict: ['Enabled']. The strictest configuration is to have this option enabled. It provides a critical security hardening measure with no negative performance impact for a partition intended solely for storing log files.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/var/log/audit' partition is mounted with the 'nodev' option. The script should parse the output of 'findmnt -n --target /var/log/audit --output OPTIONS'. If the 'nodev' option is present, the script must return the string 'Enabled'. Otherwise, it must return 'Disabled'. The output should contain only the value and no extra text.

## Remediation Script Working

Bash script that takes a single positional argument ('Enabled' or 'Disabled'). The script must modify the '/etc/fstab' entry for the '/var/log/audit' partition. If the argument is 'Enabled', it should add the 'nodev' option to the mount options if it is not already present. If the argument is 'Disabled', it should remove the 'nodev' option. After modifying '/etc/fstab', the script must attempt to remount the partition with the updated options (e.g., using 'mount -o remount /var/log/audit'). The script must return 'true' on successful modification and remount, and 'false' on failure.

