# Ensure nosuid option set on /var partition

Necessity: The 'nosuid' mount option prevents Set User ID (SUID) and Set Group ID (SGID) bits from taking effect on a filesystem. The /var directory is used for variable data files, including logs, spool directories, and temporary files. If an attacker manages to write a SUID-enabled executable to this partition (e.g., via a compromised web application), they could execute it to escalate their privileges to that of the file's owner, often root. Enforcing 'nosuid' on /var is a critical defense-in-depth measure that mitigates this local privilege escalation vector.

Auditing and Remediation: The audit script inspects the currently active mount options for the /var partition to verify if 'nosuid' is set. The remediation script ensures this setting is permanent by adding the 'nosuid' option to the corresponding entry in /etc/fstab and then applies the change to the live filesystem by remounting the partition.

Recommended State Rationale: 
Basic: The recommended state is to have the 'nosuid' option enabled. This is a foundational security best practice, recommended by standards like the CIS Benchmarks, to prevent privilege escalation from a world-writable or service-writable directory tree.
Moderate: There is no effective intermediate state for this control. The security benefit is binary; either SUID execution is permitted, or it is not. Therefore, the moderate recommendation is the same as the basic one.
Strict: For the highest level of security, the 'nosuid' option must be set. As there is no stronger configuration for this specific control, the strict recommendation remains the same as the basic and moderate levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['nosuid']` |
| **Moderate** | `['nosuid']` |
| **Strict** | `['nosuid']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `findmnt -n -o OPTIONS /var` command to check the mount options for the /var partition. The script must parse this output to determine if the 'nosuid' option is present and return only the string 'nosuid' if it is, or 'none' if it is not.

## Remediation Script Working

Bash script that takes one positional argument, which must be 'nosuid'. The script must modify the /etc/fstab file to add the 'nosuid' option to the mount options for the /var partition. It must also remount the /var partition to apply the setting immediately using `mount -o remount /var`. The script must return `true` on success and `false` on failure.

