# Ensure nodev option set on /var/tmp partition

Necessity: The 'nodev' (no devices) mount option prevents character and block special devices from being interpreted on the filesystem. Since the /var/tmp directory is world-writable, an attacker could potentially create a device file (e.g., pointing to a disk drive) using the mknod command. This could allow them to bypass file permissions and gain unauthorized access to hardware or system data. Setting the 'nodev' option on the /var/tmp partition mitigates this specific privilege escalation vector.

Auditing and Remediation: The audit script verifies the current, active mount settings for the /var/tmp partition to confirm if 'nodev' is enforced. The remediation script persistently configures this setting by modifying the /etc/fstab file, which defines how filesystems are mounted at boot, and then applies the change to the live system by remounting the partition.

Recommended State Rationale:
- Basic: ['enabled'] - This is the fundamental recommendation according to security hardening standards like the CIS Benchmarks. It provides a crucial layer of defense against a common attack technique in a high-risk directory.
- Moderate: ['enabled'] - The recommendation remains 'enabled' as there is no valid operational reason to allow device creation in /var/tmp. This control is non-negotiable for a moderately hardened system.
- Strict: ['enabled'] - For a strictly hardened system, enforcing 'nodev' is mandatory. There is no more secure state for this binary setting; it must be enabled to ensure system integrity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the mount options for the /var/tmp partition. The script must parse the output of the 'mount' or 'findmnt' command to determine if the 'nodev' option is active. If the 'nodev' option is set, the script must output only the string 'enabled'. If it is not set, or if /var/tmp is not a separate partition, it must output only the string 'disabled'.

## Remediation Script Working

bash script that modifies the mount options for the /var/tmp partition in the /etc/fstab file. The script must accept a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', it should add 'nodev' to the list of options for the /var/tmp mount point. If the argument is 'disabled', it should remove the 'nodev' option. After updating /etc/fstab, the script must attempt to remount the partition with the new options. The script must return 'true' on success and 'false' on failure.

