# Ensure nosuid option set on /var/tmp partition

Necessity: The `/var/tmp` directory is a world-writable location where temporary files are stored, accessible by all users and services. The `nosuid` (no set-user-ID) mount option prevents binaries with the SUID bit from being executed with elevated privileges from this partition. If an attacker compromises a low-privilege account and uploads a malicious SUID executable to `/var/tmp`, this option serves as a critical defense layer, preventing them from using that executable to escalate their privileges to root or another user. Misconfiguration leaves a significant local privilege escalation vector open.

Auditing and Remediation: The audit script directly queries the system's mount information for `/var/tmp` to verify if the `nosuid` option is currently active. The remediation script modifies the system's static filesystem configuration file (`/etc/fstab`) to ensure the option is present for `/var/tmp` upon every boot, and then attempts to remount the partition to apply the change immediately.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Set'. This is a foundational security control with no performance impact and no legitimate reason to be disabled on a temporary partition. Allowing SUID execution from a world-writable directory is a high-risk configuration. Therefore, enforcing `nosuid` is considered a mandatory hardening step in security standards like the CIS Benchmarks, and there is no acceptable 'less secure' state for this setting.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Set']` |
| **Moderate** | `['Set']` |
| **Strict** | `['Set']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the mount options for the /var/tmp partition. The script must use the `findmnt --noheadings --output OPTIONS --target /var/tmp` command and must only return the raw comma-separated string of mount options for the specified partition (e.g., 'rw,nosuid,nodev').

## Remediation Script Working

bash script that ensures the 'nosuid' mount option is set for the /var/tmp partition. The script should accept one argument, the desired option ('nosuid'). It must idempotently add this option to the appropriate line in /etc/fstab and then execute `mount -o remount /var/tmp` to apply the setting without a reboot. The script must return `true` if the setting is successfully applied or was already in the desired state, and `false` on failure.

