# Ensure /dev/shm is a separate partition

Necessity: The /dev/shm directory is used for temporary files and shared memory. By default, it may be part of the root filesystem. If an attacker or runaway process can write an excessive amount of data to /dev/shm, it could fill up the entire root partition, leading to a denial-of-service (DoS) condition for the entire system. Placing /dev/shm on its own partition isolates its storage, preventing it from impacting the root filesystem. Furthermore, it allows applying specific, restrictive mount options like 'noexec', 'nosuid', and 'nodev' to harden the system by preventing the execution of binaries, blocking the effects of setuid/setgid bits, and disallowing the creation of device files within this world-writable location.

Auditing and Remediation: The audit script verifies if '/dev/shm' is listed as a distinct mount point in the system's mount table. The remediation script automates the process of creating this separation by adding a correctly configured entry to '/etc/fstab' and then applying the mount, ensuring the change is persistent across reboots.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'mounted'. This is a foundational security measure with no less-secure, acceptable alternative. The isolation of /dev/shm is critical for system stability and security. The Basic, Moderate, and Strict levels all converge on this single best practice because the risk of a DoS attack or exploit execution from a shared, world-writable directory is significant enough to warrant this configuration in any production environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['mounted']` |
| **Moderate** | `['mounted']` |
| **Strict** | `['mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/dev/shm' is configured as a separate partition. The script must use a command like `findmnt --noheadings /dev/shm` to verify its mount status. If it is a separate mount point, the script must output the string 'mounted'. If it is not, it must output 'not mounted'. The output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that ensures '/dev/shm' is a separate partition. The script must accept one argument, which will be the desired state 'mount'. The script will add the entry 'tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0' to '/etc/fstab' if it does not exist, and then execute 'mount /dev/shm'. The script must return the string 'true' upon successful configuration and mounting, and 'false' if it fails.

