# Ensure nosuid option set on /dev/shm partition

Necessity: The /dev/shm partition provides a temporary file storage filesystem (tmpfs), which is world-writable by default. The 'nosuid' (no set-user-ID) mount option prevents set-user-ID (SUID) and set-group-ID (SGID) bits on executables from taking effect. Setting this option is a critical security measure to mitigate privilege escalation attacks. Without it, an attacker could place a malicious SUID executable in this world-writable location and trick a user or service into running it, allowing the attacker to gain the privileges of the file's owner (often root).

Auditing and Remediation: The audit script inspects the currently active mount options for the /dev/shm partition to verify if 'nosuid' is enforced. The remediation script modifies the system's static filesystem configuration file (/etc/fstab) to make the 'nosuid' option persistent across reboots and then applies the setting to the live filesystem by remounting it.

Recommended State Rationale: The recommendation for 'nosuid' is consistent across Basic, Moderate, and Strict levels because it is a fundamental security control with no common operational drawback. CIS Benchmarks and other security hardening standards universally recommend its use on world-writable temporary filesystems. There is no valid intermediate state; the 'nosuid' option should always be enabled on /dev/shm to prevent a well-known privilege escalation vector.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['nosuid']` |
| **Moderate** | `['nosuid']` |
| **Strict** | `['nosuid']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the mount options for the /dev/shm partition. The script must parse the live mount information, for example from the output of 'findmnt -n -o OPTIONS /dev/shm'. If the 'nosuid' option is present, the script must output the string 'nosuid'. Otherwise, it must output 'missing'. The output must not contain any other text, labels, or formatting.

## Remediation Script Working

Bash script that accepts one positional command-line argument, which will be the desired state (e.g., 'enabled'). If the argument is 'enabled', the script must ensure the 'nosuid' option is permanently configured for the /dev/shm partition in /etc/fstab and applied to the live system. It should intelligently add 'nosuid' to existing options or create the /dev/shm entry if it does not exist. The script must then attempt to remount /dev/shm to apply the setting immediately. The script must output 'true' on success and 'false' on failure.

