# Ensure noexec option set on /tmp partition

Necessity: The '/tmp' directory is a world-writable directory, meaning any user can write files to it. This makes it a common target for attackers to place and execute malicious scripts or binaries. Mounting the '/tmp' partition with the 'noexec' option prevents the execution of any programs from this location, regardless of their file permissions. This measure significantly mitigates the risk of local privilege escalation and malware execution, as it blocks a primary vector used by attackers after gaining initial access.

Auditing and Remediation: The audit script verifies the active mount configuration to ensure that the 'noexec' flag is enforced on the '/tmp' partition. The remediation script modifies '/etc/fstab' to ensure this setting persists across reboots and then remounts the partition to apply the change to the current system session.

Recommended State Rationale: Basic, Moderate, and Strict levels all recommend 'Present' because this is a foundational security control with minimal to no performance impact for most systems. The security benefit of preventing arbitrary code execution from a temporary, world-writable location is substantial and is a standard recommendation in hardening guides like the CIS Benchmarks. There is no less secure, acceptable alternative; the setting should be enabled for any security posture. Applications that require execution from '/tmp' are often poorly designed, and it is better to reconfigure the application than to weaken the system's security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the mount options for the '/tmp' partition. The script must parse the output of a command like 'findmnt -n -o OPTIONS /tmp' to check if the 'noexec' option is present. The script must return only the string 'Present' if the option is set, or 'Not Present' if it is not. There should be no other text or formatting in the output.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which will be the desired state ('Present'). If the argument is 'Present', the script must add the 'noexec' option to the '/tmp' entry in the '/etc/fstab' file. If '/tmp' is not a separate partition, this cannot be remediated. After updating '/etc/fstab', the script should apply the setting immediately by remounting the partition using a command like 'mount -o remount /tmp'. The script must return 'true' on success and 'false' on failure.

