# Ensure nosuid option set on /dev/shm partition

The '/dev/shm' filesystem is a temporary filesystem (tmpfs) that is stored in shared memory, allowing for very fast inter-process communication. Because it is often world-writable, it can be a target for attackers. The 'nosuid' mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) bits from taking effect on executables within that filesystem. This is a critical security measure to mitigate privilege escalation attacks, where an attacker might upload a SUID-enabled binary to '/dev/shm' and execute it to gain elevated permissions. The audit script verifies that the 'nosuid' option is currently active on the mounted '/dev/shm' partition. The remediation script modifies the system's static filesystem configuration in '/etc/fstab' to make the setting persistent across reboots and then applies it to the live system. As this is a foundational security setting recommended by benchmarks like CIS, there is no value in a less-secure state. Therefore, the 'enabled' state is recommended for all hardening levels (Basic, Moderate, and Strict) to ensure the system is protected against this common privilege escalation vector.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the '/dev/shm' partition is mounted with the 'nosuid' option. The script should execute `findmnt -n -o OPTIONS /dev/shm` and parse the output. It must return 'true' if 'nosuid' is present in the mount options, and 'false' otherwise. The output must contain only the boolean value, with no extra text.

## Remediation Script Working

shell script that accepts a single positional argument ('enable' or 'disable'). If the argument is 'enable', the script must add the 'nosuid' option to the '/dev/shm' entry in '/etc/fstab' and remount the partition using 'mount -o remount,nosuid /dev/shm'. If the argument is 'disable', it should remove the option from '/etc/fstab' and remount. The script must return 'true' on successful modification and 'false' on failure.

