# Ensure noexec option set on /dev/shm partition

Necessity: The /dev/shm filesystem is a temporary file storage system (tmpfs) that utilizes shared memory. It can be leveraged by attackers as a location to store and execute malicious scripts or binaries. Setting the 'noexec' mount option prevents the execution of any programs from this partition, mitigating the risk of malware execution from this volatile, world-writable location. This is a critical defense-in-depth measure that hardens the system against common attack vectors. Misconfiguration leaves a potential staging area for attackers to execute arbitrary code. Auditing and Remediation: The audit script inspects the current mount options for /dev/shm to confirm if the 'noexec' flag is active. The remediation script modifies the system's filesystem table (/etc/fstab) to make the 'noexec' option persistent across reboots and then immediately applies this setting to the live filesystem by remounting it. Recommended State Rationale: Basic: ['Enabled'] - This is the minimum recommended state according to security benchmarks like CIS. Enabling 'noexec' provides a fundamental layer of protection. Moderate: ['Enabled'] - There is no intermediate state for this control; it is either enforced or not. The moderate recommendation is identical to the basic one. Strict: ['Enabled'] - In a highly secure environment, this control must be enabled. As this is a binary setting, the strictest posture is to have it enabled, aligning with the principle of least privilege by preventing code execution in a directory not intended for that purpose.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the mount options for the /dev/shm partition. The script must parse the output of 'findmnt --noheadings --output OPTIONS /dev/shm' to determine if the 'noexec' option is present. The script must return the string 'Enabled' if the option is set, and 'Disabled' if it is not. No other text or formatting should be included in the output.

## Remediation Script Working

Bash script that accepts a single positional command-line argument ('Enabled' or 'Disabled'). If the argument is 'Enabled', the script must ensure the 'noexec' option is added to the /dev/shm entry in /etc/fstab and then apply the change by remounting the partition using 'mount -o remount,noexec /dev/shm'. If the argument is 'Disabled', the script must remove the 'noexec' option. The script must return the string 'true' on successful modification or 'false' on failure.

