# Ensure /tmp is a separate partition

Necessity: Separating the /tmp directory onto its own partition is a critical security and stability measure. It prevents processes from filling up the /tmp directory and causing a denial of service by consuming all the storage space on the root filesystem. Furthermore, it allows the partition to be mounted with specific security-hardening options, such as 'noexec', 'nosuid', and 'nodev'. These options prevent the execution of unauthorized programs from a world-writable location, block setuid/setgid flags from taking effect, and disallow the creation of device files, mitigating common attack vectors for privilege escalation.

Auditing and Remediation: The audit script verifies that '/tmp' is listed as a distinct mount point in the system's filesystem table. Remediation is a complex manual process that involves partitioning a disk, creating a filesystem, updating the /etc/fstab file with the new partition and appropriate mount options, and then mounting it. Due to the destructive and system-specific nature of disk partitioning, automated remediation is not recommended, and the remediation script is designed to fail to enforce manual review.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'mounted'. This is a foundational security best practice with no less-secure alternative. Any compliant system, regardless of its hardening level, should have /tmp isolated. While the core requirement is simply having a separate partition, stricter implementations would also enforce specific mount options ('noexec', 'nosuid', 'nodev') on that partition, which can be handled as a separate security control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['mounted']` |
| **Moderate** | `['mounted']` |
| **Strict** | `['mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/tmp' is configured on a separate partition. The script must parse the system's mount information (e.g., from 'findmnt /tmp' or '/proc/mounts') to determine if '/tmp' has its own dedicated mount point. The script should output only the string 'mounted' if it is a separate partition, or 'not mounted' if it is not. There should be no other text in the output.

## Remediation Script Working

Bash script that serves as a placeholder for the manual remediation process. The script should accept one argument. Since creating and configuring a separate partition for '/tmp' involves complex manual steps like disk partitioning and fstab modification which cannot be safely automated in a generic script, this script must always return 'false' to indicate that manual administrator intervention is required. This prevents unintended automated actions on the system's storage configuration.

