# Ensure nodev option set on /dev/shm partition

The /dev/shm filesystem provides a temporary file storage system using shared memory, which can significantly improve performance for certain applications. However, because it is often mounted as world-writable, it can be abused by attackers.

**Necessity:** The 'nodev' mount option prevents the creation or interpretation of character or block special devices on the filesystem. Without this option, an attacker with write access to /dev/shm could create a malicious device file (e.g., a block device pointing to a raw disk partition) and potentially trick a privileged process into reading from or writing to it. This could lead to sensitive information disclosure, data corruption, or privilege escalation. Enforcing the 'nodev' option is a critical security measure to mitigate this threat.

**Auditing and Remediation:** The audit script checks the active mount configuration for the /dev/shm partition to verify if the 'nodev' flag is currently enforced. The remediation script modifies the system's static filesystem configuration file ('/etc/fstab') to ensure the 'nodev' option is applied every time the system boots. It then remounts the partition to enforce the setting without requiring a reboot.

**Recommended State Rationale:**
- **Basic:** ['Enabled']. This is the fundamental recommended state according to security benchmarks like CIS. Enabling 'nodev' closes a well-known vulnerability vector.
- **Moderate:** ['Enabled']. There is no intermediate state for this setting. It is either enforced or not. The recommendation remains 'Enabled'.
- **Strict:** ['Enabled']. For the highest level of security, this setting must be enabled. There are no common use cases for allowing device creation in /dev/shm on a hardened system, so this state is identical to Basic and Moderate.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/dev/shm' partition is currently mounted with the 'nodev' option. The script must output only the string 'true' if the option is present, or 'false' if it is not, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'enabled'. When run, the script must add the 'nodev' option to the '/dev/shm' filesystem entry in '/etc/fstab' if it is not already present, ensuring it persists across reboots. It must also remount the partition to apply the setting immediately. The script must return 'true' on success and 'false' on failure.

