# Ensure /dev/shm is a separate partition

Necessity: The /dev/shm directory is used for temporary files and shared memory. If it is not a separate partition, it resides on the root filesystem. This creates a security risk where an attacker could fill /dev/shm, potentially causing a denial-of-service by exhausting space on the root partition. Mounting it as a separate tmpfs partition allows for size restrictions and the application of specific security options like 'nodev' (prevent device creation), 'nosuid' (ignore SUID/SGID bits), and 'noexec' (prevent execution of binaries). These options are critical for preventing privilege escalation and code execution from a world-writable location. Auditing and Remediation: The audit script verifies if /dev/shm has its own entry in the system's mount table, confirming its status as a separate filesystem. The remediation script automates the process of adding a correctly configured line to /etc/fstab for /dev/shm and then applies the configuration by remounting it, thereby isolating it from the root filesystem and applying restrictive security options. Recommended State Rationale: Basic, Moderate, and Strict: All levels recommend the state ['mounted']. For this control, the configuration is binary; it is either correctly configured or it is not. The security benefit is achieved by creating the separate partition and applying security-hardening mount options. The remediation should always implement the strict configuration ('nodev', 'nosuid', 'noexec') as there is no significant operational drawback and it provides the maximum security benefit recommended by benchmarks like the CIS CentOS 7 Benchmark.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['mounted']` |
| **Moderate** | `['mounted']` |
| **Strict** | `['mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if /dev/shm is configured as a separate mount point. The script must output 'mounted' if it is listed as a separate entry in the system's mount table (e.g., in /proc/mounts), and 'not mounted' otherwise. The output must contain only one of these two strings and nothing else.

## Remediation Script Working

Bash script that ensures /dev/shm is mounted as a separate tmpfs partition. The script must accept one argument: the desired state, which must be 'mounted'. Upon receiving this argument, the script must add or correct the entry for /dev/shm in /etc/fstab to 'tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0' and then attempt to remount /dev/shm with these options. The script must return `true` on success and `false` on failure.

