# Ensure separate partition exists for /var

Necessity: Separating the `/var` partition is crucial for system stability and security. The `/var` directory contains variable data such as logs, mail spools, and temporary cache files, which can grow unpredictably. If `/var` is on the root filesystem, a process that generates excessive logs or data could fill the entire root partition, leading to a system-wide denial of service and potential data corruption. By isolating `/var`, you contain this risk. Furthermore, a separate partition allows for mounting with specific, more restrictive security options like `noexec` (preventing execution of binaries), which hardens the system against certain attacks where an adversary might write a malicious executable to a world-writable directory within `/var`.

Auditing and Remediation: The audit script verifies if `/var` is a distinct mount point by comparing its underlying block device with that of the root filesystem. Remediation is a complex, high-risk manual procedure that involves provisioning a new partition, booting into a maintenance mode, copying all data from the existing `/var` directory to the new partition, updating the `/etc/fstab` configuration file to mount the new partition at `/var` on subsequent boots, and then rebooting the system. This process is not suitable for automation.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly `['true']`. This is a foundational configuration best practice outlined in security benchmarks like CIS. There is no partial compliance; the system either has a separate `/var` partition, gaining the associated stability and security benefits, or it does not. Therefore, all security postures require this control to be in place.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['true']` |
| **Moderate** | `['true']` |
| **Strict** | `['true']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if `/var` is mounted on a separate partition from the root (`/`) filesystem. The script must output `true` if it is a separate partition and `false` if it is not. The output should not contain any extra text or formatting, only the boolean value.

## Remediation Script Working

Automated remediation for this control is not recommended due to the high risk of data loss and system instability. Creating a new partition, migrating data, and modifying `/etc/fstab` requires careful manual intervention. Therefore, a remediation script should not be created. For compliance with tooling that requires a script, create a script that accepts a dummy argument, logs that manual action is required, and returns `false` to indicate that automated remediation was not and cannot be performed.

