# Ensure /tmp is a separate partition

Necessity: Separating the /tmp directory into its own partition is a critical security and system stability measure. It prevents processes from filling up the /tmp directory and exhausting disk space on the root filesystem, which could lead to a denial of service for the entire system. Furthermore, it allows for the application of specific, restrictive mount options (such as noexec, nosuid, and nodev) to the /tmp partition, which significantly hardens the system against attacks. These options prevent the execution of programs, block set-user-identifier (SUID) bits from taking effect, and prevent the creation of device files, thereby mitigating risks from malware or malicious user scripts placed in the world-writable /tmp directory.

Auditing and Remediation: The audit script verifies the system's current configuration by checking the list of active mount points to determine if /tmp is mounted as a dedicated filesystem. Remediation is a manual administrative task that involves partitioning a disk, creating a filesystem, adding an entry to /etc/fstab to ensure the partition is mounted as /tmp at boot, and then mounting it. Due to the risk of data loss and the need for system-specific decisions (e.g., disk and partition size), this process cannot be safely automated in a generalized script.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Mounted'. This is a foundational security control with no intermediate levels; the partition is either separate or it is not. The CIS Benchmarks and other security standards mandate this separation as a baseline requirement. Achieving this state is the primary goal, which then enables further hardening by applying restrictive mount options, a step often associated with Moderate to Strict security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Mounted']` |
| **Moderate** | `['Mounted']` |
| **Strict** | `['Mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if /tmp is a separate mount point. The script should output 'Mounted' if it is, and 'Not Mounted' if it is not. The output must be the string value only, with no other text or formatting.

## Remediation Script Working

This configuration requires manual intervention by a system administrator and cannot be safely automated with a simple script. The process involves creating a new partition, formatting it, and updating the /etc/fstab file. Therefore, a remediation script that accepts a simple argument is not applicable. The script should be designed to return `false` to indicate that manual action is required.

