# Ensure noexec option set on /tmp partition

Necessity: The /tmp directory is a world-writable location where any user can store temporary files. Attackers often exploit this to download and execute malicious scripts or binaries. Setting the 'noexec' mount option prevents any program from being executed from the /tmp partition, regardless of its file permissions. This significantly mitigates the risk of privilege escalation and malware execution by rendering downloaded payloads inert. Failure to enforce this control leaves a common and easily exploitable vector for system compromise open. Auditing and Remediation: The audit script directly queries the system's mount information for the /tmp partition to verify if the 'noexec' flag is active. The remediation script modifies the filesystem table (/etc/fstab) to make the 'noexec' option persistent across reboots and then applies the setting to the live system by remounting the partition. Recommended State Rationale: Basic, Moderate, and Strict levels all recommend the state be 'enabled'. This is a foundational security control with no gradations; the system is either protected from this attack vector or it is not. Allowing executables in a world-writable temporary directory is considered a high-risk configuration in any security framework (e.g., CIS Benchmarks). Therefore, the only acceptable state for any level of hardening is to have this protection enabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the /tmp partition is mounted with the 'noexec' option. The script should parse the output of 'findmnt --noheadings --output OPTIONS --target /tmp'. If 'noexec' is present in the options, the script must return the string 'enabled'. Otherwise, it must return 'disabled'. The output must contain only the returned string and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled'. If the argument is 'enabled', the script must ensure the 'noexec' option is present for the /tmp entry in /etc/fstab and then remount the partition using 'mount -o remount /tmp' to apply the change immediately. The script must return 'true' upon successful modification or if the state is already correct, and 'false' on failure.

