# Ensure noexec option set on /var/tmp partition

The necessity of setting the `noexec` option on the `/var/tmp` partition is to mitigate the risk of unauthorized code execution. The `/var/tmp` directory is intended for temporary files that should persist across reboots and is often world-writable. Attackers can leverage this by placing malicious scripts or binaries in this directory and then executing them to escalate privileges or establish persistence. By mounting this partition with the `noexec` option, the operating system is instructed to prevent the execution of any programs residing on it, regardless of their file permissions. This significantly reduces the system's attack surface. The audit script verifies this protection by checking the current mount options for `/var/tmp`. The remediation script hardens the system by modifying the filesystem table (`/etc/fstab`) to enforce this rule persistently and then immediately remounts the partition to apply the change. A state of 'enabled' is recommended for all security levels (Basic, Moderate, and Strict) because this is a foundational security measure with no performance impact. There is no valid scenario in a hardened environment where allowing execution from a world-writable temporary directory is acceptable, making this a binary and critical configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the mount options for the `/var/tmp` partition. The script must use the `findmnt -n -o OPTIONS --target /var/tmp` command. If the `noexec` option is present in the output, the script must return the string 'enabled'. Otherwise, it must return 'disabled'. The script's output must consist solely of the returned string.

## Remediation Script Working

bash script that accepts a single positional command-line argument, which must be the string 'enabled'. If the argument is 'enabled', the script must add the `noexec` option to the `/var/tmp` entry in `/etc/fstab`, creating the entry if it does not exist for a separate partition. It must then remount `/var/tmp` using `mount -o remount,noexec /var/tmp` to apply the setting immediately. The script must return the boolean `true` on success and `false` on failure.

