# Ensure separate partition exists for /var/tmp

Necessity: Isolating /var/tmp onto its own partition is a critical security measure to prevent filesystem-based denial-of-service attacks and to enhance system hardening. Since /var/tmp is typically world-writable, a malicious user or process could fill it with data, potentially consuming all available space on the root filesystem ('/') and causing the entire system to crash or become unresponsive. Separating it allows for applying specific, restrictive mount options such as 'nodev', 'nosuid', and 'noexec', which prevent device creation, disable set-user-identifier bits, and block the execution of binaries from this directory, respectively. This significantly mitigates the risk of malware execution and privilege escalation.

Auditing and Remediation: The audit script examines the system's mount points to verify if /var/tmp is configured as a distinct filesystem. The remediation for this finding is a complex manual process that involves disk partitioning, filesystem creation, editing the system's filesystem table (/etc/fstab), and migrating existing data. Due to the high risk of data loss and system instability, the remediation script is designed to fail safely and explicitly state that a system administrator must perform these steps manually.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Enabled'. This is a binary control; the partition is either separate or it is not. This configuration is considered a fundamental security best practice, as recommended by benchmarks like CIS. The benefits of isolating this temporary directory—preventing resource exhaustion attacks and allowing for restrictive mount options—are essential for any level of system security hardening. There is no less-secure 'Basic' or 'Moderate' configuration that still provides meaningful protection.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/var/tmp' is mounted on a separate partition. The script should use a command like `findmnt --noheadings --output SOURCE --target /var/tmp` and check if the output is not empty and differs from the source of its parent directory. It must return only the string 'Enabled' if it is a separate partition, and 'Disabled' otherwise, with no extra text.

## Remediation Script Working

Bash script that accepts a single argument. As creating a separate partition requires manual system administrator intervention (e.g., disk partitioning, updating /etc/fstab, data migration), this script should not attempt to perform these actions. The script's purpose is to acknowledge the remediation request. It should log a message stating that manual intervention is required to create a separate /var/tmp partition and must always return 'false' to indicate that automated remediation was not performed.

