# Ensure nosuid option set on /tmp partition

Necessity: The 'nosuid' (no set user ID) mount option prevents the execution of setuid programs stored on the /tmp partition. The /tmp directory is world-writable, making it a common target for attackers. If an attacker can place a malicious SUID-enabled binary in /tmp and trick a user or system process into executing it, they could escalate their privileges, potentially to root. Enforcing 'nosuid' on /tmp is a critical security measure that mitigates this privilege escalation vector by ensuring SUID bits on files in this partition are ignored.

Auditing and Remediation: The audit script inspects the system's current mount information (typically via `findmnt` or by parsing `/proc/mounts`) to verify if the '/tmp' partition is actively mounted with the 'nosuid' flag. The remediation script modifies the '/etc/fstab' configuration file to ensure this setting is applied persistently across reboots and then remounts the filesystem to enforce the rule immediately.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'enabled'. This is because the risk associated with not having the 'nosuid' option is significant and the performance impact of enabling it is negligible. It is a foundational security best practice recommended by benchmarks like the Center for Internet Security (CIS). There is no valid security posture where allowing SUID execution from a world-writable temporary directory is acceptable, hence the recommendation is consistent across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes `findmnt -n -o OPTIONS /tmp` and checks if the output contains the 'nosuid' option. The script must output only the string 'true' if the option is present, and 'false' otherwise, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument (e.g., 'enabled'). If the argument is 'enabled', the script must modify the '/etc/fstab' file to add the 'nosuid' option to the mount options for the '/tmp' partition. If an entry for '/tmp' does not exist, no action should be taken. After updating '/etc/fstab', the script must remount the '/tmp' partition to apply the changes immediately using `mount -o remount /tmp`. The script must return the string 'true' on success and 'false' on failure.

