# Ensure nosuid option set on /home partition

Necessity: The 'nosuid' (no set-user-ID) mount option prevents set-user-identifier or set-group-identifier bits from taking effect within a filesystem. Malicious users could introduce SUID-enabled programs in their home directories. If an administrator or another user accidentally executes such a program, it could run with the owner's privileges, leading to privilege escalation. Enforcing 'nosuid' on the /home partition is a critical defense-in-depth measure that mitigates this risk by ensuring user-uploaded or user-created executables cannot be used to elevate privileges.

Auditing and Remediation: The audit script inspects the currently active mount options for the /home partition to verify if 'nosuid' is enforced. The remediation script modifies the system's filesystem table (/etc/fstab) to make the 'nosuid' option persistent across reboots and then immediately applies the setting to the live filesystem by remounting the partition.

Recommended State Rationale: 
Basic: The recommended state is 'Present' as this is a fundamental security hardening step recommended by benchmarks like CIS. It addresses a common and significant privilege escalation vector with minimal impact on standard user functionality.
Moderate & Strict: For this specific control, there is no meaningful distinction between security levels. The 'nosuid' option is either present or absent. Its absence represents a security vulnerability that should be remediated regardless of the desired hardening level. Therefore, the 'Present' state is required for Basic, Moderate, and Strict configurations alike, as it provides an essential security guarantee.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks the mount options for the /home partition. The script must parse the output of 'findmnt -n -o OPTIONS /home' to determine if the 'nosuid' option is present. It should return only the string 'Present' if the option is set, or 'Absent' if it is not.

## Remediation Script Working

shell script that accepts a single positional argument, which should be the string 'Present'. The script must idempotently add the 'nosuid' option to the /home entry in /etc/fstab and then remount the /home partition to apply the setting using 'mount -o remount /home'. The script must return 'true' upon successful modification and remount, and 'false' on failure.

