# Ensure nodev option set on /var/log partition

The 'nodev' option prevents character and block special devices from being created or interpreted on a filesystem. The /var/log directory is intended to store log files, which are typically plain text. Allowing device files to be created in this partition could enable an attacker who gains write access to create a device node (e.g., pointing to a raw disk) and use it to escalate privileges or access sensitive hardware directly. The audit script checks the live mount options for the '/var/log' partition. The remediation script ensures this setting is persistent by modifying the '/etc/fstab' file and applies it to the running system. Since this is a binary security control (either enabled or disabled), the Basic, Moderate, and Strict recommended states are all 'Enabled' to fully mitigate the associated risk as per security best practices like the CIS Benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that verifies if the '/var/log' mount point exists in the partition table and is configured with the 'nodev' option. The script must parse the output of 'findmnt -n --target /var/log --output OPTIONS'. It should return only 'true' if the option is present, and 'false' otherwise, including the case where '/var/log' is not a separate partition.

## Remediation Script Working

Bash script that takes one argument to enforce the 'nodev' option on the '/var/log' partition. The script must locate the '/var/log' entry in '/etc/fstab', add the 'nodev' option if it is not present, and then execute 'mount -o remount /var/log' to apply the change immediately. The script must return 'true' upon successful modification and remount, and 'false' on failure or if '/var/log' is not a distinct partition.

