# Ensure noexec option set on /dev/shm partition

Necessity: The /dev/shm directory is a temporary file storage filesystem that utilizes shared memory. Attackers can potentially write malicious executables or scripts to this world-writable location and execute them to elevate privileges or establish persistence. Setting the 'noexec' option prevents any files on this filesystem from being executed, mitigating this common attack vector and enhancing system security as part of a defense-in-depth strategy.

Auditing and Remediation: The audit script verifies the current, active mount options for the /dev/shm partition to confirm if 'noexec' is enforced. The remediation script modifies the system's filesystem table (/etc/fstab) to make the 'noexec' option persistent across reboots and then remounts /dev/shm to apply the setting to the live session.

Recommended State Rationale: This is a binary security control with a clear best practice. Basic: 'enabled' is the fundamental recommendation according to security benchmarks like CIS. It closes a significant and easily exploitable vulnerability. Moderate: 'enabled' remains the recommendation as there is no effective intermediate state; the partition either allows execution or it does not. Strict: 'enabled' is the only acceptable state for a high-security environment. Disallowing execution from a temporary, shared memory partition is a critical hardening step with very low risk of impacting legitimate system functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that inspects the mount options for the /dev/shm partition. The script should check if the 'noexec' option is present in the output of the 'findmnt -n -o OPTIONS /dev/shm' command. The script must output only the string 'true' if the option is set, and 'false' if it is not, with no additional text or formatting.

## Remediation Script Working

shell script that accepts a single positional argument, which must be 'enabled'. If the argument is 'enabled', the script will add the 'noexec' option to the /dev/shm entry in /etc/fstab to ensure persistence. It will then immediately apply the setting by remounting the partition using 'mount -o remount,noexec /dev/shm'. The script must return the string 'true' upon successful modification and remount, and 'false' if any part of the process fails.

