# Ensure nosuid option set on /home partition

Necessity: The `nosuid` (no set-user-ID) mount option prevents set-user-ID (SUID) and set-group-ID (SGID) bits from taking effect. The /home partition is writable by non-privileged users. If this option is not set, a user could introduce a SUID-enabled program (either maliciously or unintentionally) which could then be executed with the privileges of the file's owner, often `root`. This creates a significant privilege escalation vulnerability. Enforcing `nosuid` on /home is a critical defense-in-depth measure to mitigate this risk. Auditing and Remediation: The audit script verifies that the /home partition is currently mounted with the `nosuid` option. The remediation script ensures this configuration is persistent by adding the `nosuid` option to the appropriate entry in `/etc/fstab` and then remounts the partition to apply the change immediately. Recommended State Rationale: Basic, Moderate, and Strict states all recommend this setting be enabled. This is a foundational security hardening step with no common operational drawbacks. As recommended by security frameworks like the CIS Benchmarks, any partition containing user-writable directories should have this protection. There is no less-secure but acceptable state; the risk of privilege escalation is too high to justify leaving it disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the mount options for the /home partition. The script must check if the `nosuid` option is currently active by parsing the output of `findmnt -n -o OPTIONS --target /home`. It must output only the string 'true' if the option is set, and 'false' if it is not, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'enabled'. The script must modify the /etc/fstab file to add the `nosuid` option to the mount options for the /home partition. After updating the file, the script must apply the setting by remounting the partition using `mount -o remount /home`. The script must return `true` upon successful modification and remount, and `false` otherwise.

