# Ensure nodev option set on /dev/shm partition

Necessity: The /dev/shm filesystem is a temporary file storage system that resides in memory. The 'nodev' mount option prevents character or block special devices from being created on this filesystem. Malicious users or compromised services could otherwise create device files in this world-writable location to attempt to bypass permissions and gain elevated access to hardware, potentially leading to a full system compromise. Enforcing 'nodev' is a critical hardening step to mitigate this privilege escalation vector.

Auditing and Remediation: The audit script inspects the currently active mount options for /dev/shm to verify if the 'nodev' flag is set, providing a real-time status of the system's configuration. The remediation script modifies the `/etc/fstab` file to ensure the 'nodev' option is persistently applied across reboots and then immediately applies the setting to the live filesystem by remounting it.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is 'present'. This is a foundational security control with no legitimate operational downside on the vast majority of systems. As recommended by security standards like the CIS Benchmarks, it provides a crucial layer of defense against a specific type of privilege escalation attack. Because the setting is binary (either it is secure or it is not), there is no intermediate 'Moderate' state; it should always be enabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the mount options for the /dev/shm partition. The script must query the currently active mount options using a command like `findmnt -n -o OPTIONS /dev/shm`. It should then check if the 'nodev' option is present in the output. If 'nodev' is found, the script must output the string 'present'. If it is not found, it must output 'absent'. The output should contain only one of these two strings and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state ('present'). If the argument is 'present', the script must add the 'nodev' option to the /dev/shm entry in /etc/fstab if it does not already exist. It should then attempt to remount /dev/shm with the new options using `mount -o remount /dev/shm`. The script must return 'true' if the modification and remount were successful, and 'false' otherwise.

