# Ensure nodev option set on /tmp partition

The 'nodev' (no devices) mount option prevents character and block special devices from being interpreted on a given filesystem. The /tmp directory is a world-writable location where any user can create files, which presents a security risk. If an attacker can create a device file in /tmp (e.g., a file pointing to a raw disk partition), they could potentially use it to bypass file permissions and access sensitive system data or gain elevated privileges. The audit script verifies that the /tmp partition is actively mounted with the 'nodev' option. The remediation script ensures this setting is made persistent in /etc/fstab and applies it to the live system by remounting the partition. The recommended state is uniformly 'enabled' across all security levels (Basic, Moderate, and Strict) because there is no legitimate use case for allowing device files in a temporary, world-writable directory. This is a fundamental security hardening practice recommended by benchmarks like CIS to prevent privilege escalation and unauthorized data access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the mount options for the /tmp partition. The script must parse the output of 'findmnt --noheadings --output OPTIONS /tmp' to determine if the 'nodev' option is present. If 'nodev' is set, the script must output the string 'enabled'. Otherwise, it must output 'disabled'. The output must not contain any other text, labels, or formatting.

## Remediation Script Working

bash script that configures the 'nodev' mount option for the /tmp partition. The script must accept a single positional argument: 'enabled'. When 'enabled' is passed, the script must first check the /etc/fstab file and add the 'nodev' option to the /tmp entry if it is not already present. It must then remount the /tmp partition using 'mount -o remount,nodev /tmp' to apply the setting immediately. The script must return 'true' on successful modification or if the setting is already correctly configured, and 'false' on failure.

