# Ensure nosuid option set on /var/log partition

Necessity: The 'nosuid' (no set user ID) mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) bits from taking effect on executables within a filesystem. The /var/log partition is designated for storing log files, which may be written to by various users and system processes. If an attacker gains write access to this partition, they could introduce a malicious SUID executable. If another user later runs this executable, it would execute with the permissions of the file's owner (e.g., root), leading to a privilege escalation attack. Enforcing 'nosuid' on /var/log is a critical defense-in-depth measure that mitigates this risk by ensuring that no programs on that partition can be executed with elevated privileges, regardless of their permission bits.

Auditing and Remediation: The audit script examines the system's current mount configuration for the /var/log partition to verify if the 'nosuid' flag is active. The remediation script ensures this setting is persistent by adding the 'nosuid' option to the appropriate entry in the /etc/fstab file and then remounts the partition to apply the change without requiring a system reboot.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'present'. This is a binary security control with no intermediate value. The risk associated with not having this protection is significant and does not vary by hardening level. Major security benchmarks, such as the CIS Benchmarks, mandate this setting as a fundamental security best practice. Therefore, it must be enabled in all secure configurations to prevent a well-known privilege escalation vector.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'nosuid' option is set for the /var/log partition. The script must query the active mount points and output 'present' if the option is set for /var/log, and 'absent' if it is not. The output must contain only the resulting string and no other text.

## Remediation Script Working

Bash script that accepts a single positional argument, 'present'. If the argument is 'present', the script must modify the /etc/fstab file to add the 'nosuid' option to the mount entry for /var/log. It should then remount the partition to apply the setting immediately. The script must return 'true' on successful modification and remount, and 'false' otherwise.

