# Ensure nosuid option set on /var/log partition

Necessity: The 'nosuid' mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) bits from taking effect on executables within a filesystem. SUID programs run with the permissions of the file owner, not the user who executes them. If an attacker gains write access to /var/log (e.g., through a compromised logging service), they could place a malicious SUID-enabled executable there. Without the 'nosuid' flag, they could then execute this file to escalate their privileges, often to root. Enforcing 'nosuid' on /var/log is a critical security measure that mitigates this specific privilege escalation vector by ensuring that no programs stored there can be executed with elevated rights.

Auditing and Remediation: The audit script verifies the live system configuration by checking the active mount options for the /var/log partition. The remediation script ensures this configuration is persistent by modifying the system's filesystem table (/etc/fstab) to include the 'nosuid' option for /var/log and then applies the setting to the live system via a remount command.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is to have the 'nosuid' option set. This is a foundational security best practice recommended by benchmarks like CIS. There is no valid operational reason to allow SUID executables in a log directory. Therefore, this setting is not graduated; it is a binary control that should always be enabled to reduce the system's attack surface. The security benefit is significant and comes with no performance or compatibility drawbacks for a log partition.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['nosuid']` |
| **Moderate** | `['nosuid']` |
| **Strict** | `['nosuid']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks the mount options for the /var/log partition. The script must use the 'findmnt' command to query the active mount options. If the 'nosuid' option is present, the script must output the string 'nosuid'. If the partition does not exist or the option is not set, it must output 'missing'. The output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

shell script that accepts one positional argument, which will be the desired option to set (e.g., 'nosuid'). The script must find the /var/log entry in /etc/fstab. If the entry exists, it should add the 'nosuid' option to the fourth column (mount options), preserving existing options. After updating /etc/fstab, the script must execute 'mount -o remount /var/log' to apply the change. The script must return 'true' on success and 'false' if it fails to find the partition in fstab or if the remount command fails.

