# Ensure noexec option set on /var/log/audit partition

Necessity: The 'noexec' mount option prevents the execution of binary programs from a specific partition. Since the /var/log/audit directory is intended exclusively for storing audit log files, there is no legitimate reason for any executable to reside or run from this location. Setting the 'noexec' option enforces the principle of least privilege and provides a critical layer of defense. It mitigates the risk of an attacker writing a malicious executable to a log file (e.g., via a compromised application) and then executing it to escalate privileges or establish persistence on the system.

Auditing and Remediation: The audit script verifies the current system state by parsing the output of the 'findmnt' command to check for the presence of the 'noexec' flag on the /var/log/audit partition's mount options. The remediation script directly modifies the system's filesystem table (/etc/fstab) to ensure the setting persists across reboots. It then uses the 'mount' command with the 'remount' option to apply the configuration to the live filesystem without requiring a system restart.

Recommended State Rationale: 
- Basic: Recommends ['Enabled']. This is the fundamental security baseline. Any partition dedicated to data storage, especially sensitive logs, should not permit program execution.
- Moderate: Recommends ['Enabled']. For this binary setting, the moderate state is identical to the basic state, as there is no middle ground. The security benefit is significant and has no performance or operational drawback.
- Strict: Recommends ['Enabled']. The strictest security posture mandates this setting be enabled. Disabling 'noexec' on a log partition would represent an unacceptable security vulnerability in any hardened environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the mount options for the /var/log/audit partition. The script must use the 'findmnt -n -o OPTIONS --target /var/log/audit' command. If the output contains the 'noexec' option, the script shall output 'Enabled'. If the partition does not exist or the 'noexec' option is not present, it shall output 'Disabled'. The script must only return the resulting value.

## Remediation Script Working

bash script that accepts a single positional argument, which must be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the 'noexec' option to the /var/log/audit entry in /etc/fstab if it is not already present, and then remount the partition using 'mount -o remount,noexec /var/log/audit'. If the argument is 'Disabled', it must remove the 'noexec' option. The script must return 'true' upon successful modification or if the state is already correct, and 'false' upon failure.

