# Ensure noexec option set on /var/log partition

Necessity: The /var/log directory is the standard location for system and application logs. It should not contain executable files. An attacker who compromises a service could potentially write a malicious binary to a log file and attempt to execute it. Setting the 'noexec' mount option prevents any binaries from being executed from the /var/log partition, regardless of their file permissions. This mitigates the risk of arbitrary code execution from a location that may be writable by unprivileged services, providing a critical layer of defense-in-depth.

Auditing and Remediation: The audit script checks the system's active mount points to determine if /var/log is on a dedicated partition and, if so, whether the 'noexec' option is applied. The remediation script modifies the system's filesystem table (/etc/fstab) to persistently add the 'noexec' option to the /var/log mount entry and then remounts the partition to enforce the change immediately.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'enabled'. This is a foundational security control with no intermediate levels of compliance; either execution is prevented or it is not. Security standards like the CIS Benchmarks mandate this configuration because it significantly reduces the attack surface by preventing a common privilege escalation and persistence vector. There is no legitimate operational reason for binaries to be executed from /var/log, so this setting should be enabled in all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the mount options for the /var/log partition. The script must first determine if /var/log is mounted on a separate partition. If it is not, the script must output 'Not a separate partition'. If it is a separate partition, the script must check if the 'noexec' option is present. If 'noexec' is set, the script must output 'enabled'; otherwise, it must output 'disabled'. The output must contain only one of these exact strings and nothing else.

## Remediation Script Working

Bash script that configures the mount options for the /var/log partition. The script must accept one positional argument: 'enabled'. If the argument is 'enabled' and /var/log is a separate partition, the script will add the 'noexec' option to the /var/log entry in /etc/fstab and remount the partition to apply the setting. If /var/log is not a separate partition, the script must fail. The script must output the boolean value 'true' on success or 'false' on failure.

