# Ensure nodev option set on /tmp partition

Necessity: The '/tmp' directory is a world-writable location where any user can create files. The 'nodev' (no devices) mount option prevents character or block special device files from being created or interpreted on this filesystem. Without this option, an attacker could create a device file in '/tmp' to potentially gain direct access to hardware, bypass file system permissions, or interact with kernel drivers, creating a significant vector for privilege escalation and system compromise.

Auditing and Remediation: The audit script instruction is to check the live mount configuration for the '/tmp' partition to determine if the 'nodev' option is active. The remediation script instruction is to modify '/etc/fstab' to ensure the 'nodev' option is persistently applied to the '/tmp' mount across reboots, and then remount the partition to apply the setting immediately.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'set'. There is no acceptable security scenario where allowing device files in a world-writable temporary directory is advisable. This configuration is a standard baseline requirement in security benchmarks like the CIS Benchmarks. Because the risk of not having this option set is high and the operational impact of setting it is negligible, it is considered a mandatory setting for any level of system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['set']` |
| **Moderate** | `['set']` |
| **Strict** | `['set']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/tmp' partition is mounted with the 'nodev' option. The script should use the 'findmnt' command to verify the current mount options. It must output only the string 'set' if the option is present, and 'not set' if it is not, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'set'. The script should idempotently modify the '/etc/fstab' file to add the 'nodev' option to the mount entry for '/tmp'. If '/tmp' is not configured as a separate partition in '/etc/fstab', the script should take no action. After updating the file, it should remount '/tmp' using 'mount -o remount /tmp' to apply the change immediately. The script must output the string 'true' on success and 'false' on failure.

