# Ensure nodev option set on /var/log/audit partition

Necessity: The 'nodev' option prevents the creation or interpretation of character and block special devices on a specific filesystem. Since the '/var/log/audit' partition is designated for storing critical security audit logs, it should never need to host device files. Allowing device files on this partition could enable an attacker to create a malicious device (e.g., pointing to a raw disk) to bypass file permissions, escalate privileges, or tamper with system integrity. Enforcing 'nodev' mitigates this specific attack vector. Auditing and Remediation: The audit script verifies that the '/var/log/audit' entry in the system's active mount points includes the 'nodev' flag. The remediation script modifies the '/etc/fstab' file to ensure this setting is applied persistently across reboots and then remounts the filesystem to enforce the change immediately. Recommended State Rationale: Basic: ['Enabled'] - This is a fundamental security hardening step recommended by benchmarks like CIS. It provides a baseline defense against privilege escalation. Moderate: ['Enabled'] - The recommendation remains 'Enabled' as this is a binary control; it is either secure or it is not. There is no middle ground for this setting. Strict: ['Enabled'] - In a highly secure environment, enforcing this control is non-negotiable. Disabling device creation in a partition containing sensitive security logs is a critical measure to protect the integrity of forensic data and prevent system compromise.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/var/log/audit' partition is mounted with the 'nodev' option. The script should parse the output of 'findmnt --noheadings --output OPTIONS /var/log/audit'. It must return 'Enabled' if 'nodev' is present in the options string, and 'Disabled' if it is not. The output must contain only the value ('Enabled' or 'Disabled') with no extra text.

## Remediation Script Working

Bash script that configures the 'nodev' mount option for the '/var/log/audit' partition. The script must accept one positional argument: 'Enabled' or 'Disabled'. If 'Enabled', it should add the 'nodev' option to the mount entry for '/var/log/audit' in '/etc/fstab' and remount the partition. If 'Disabled', it should remove the 'nodev' option and remount. The script must return 'true' on success and 'false' on failure.

