# Ensure nodev option set on /var partition

Necessity: The 'nodev' mount option prevents the creation and interpretation of character and block special devices on a given filesystem. The /var directory is intended for variable data like logs, caches, and spool files, and should never contain device files. If an attacker gains write access to /var, they could create a device file (e.g., pointing to a raw disk) to attempt privilege escalation or to gain unauthorized access to hardware. Enforcing the 'nodev' option mitigates this risk by ensuring device files within /var are not interpreted by the kernel.

Auditing and Remediation: The audit script verifies the current, active mount options for the /var partition to confirm that 'nodev' is set. The remediation script modifies the '/etc/fstab' file to ensure the setting persists across reboots and then remounts the /var partition to apply the change to the live system without requiring a restart.

Recommended State Rationale: 
- Basic: Recommends 'Enabled'. This is a fundamental security hardening practice recommended by security benchmarks like CIS. It provides a crucial layer of defense against privilege escalation attacks.
- Moderate: Recommends 'Enabled'. As this is a binary security setting (either on or off), there is no effective intermediate state. The moderate recommendation maintains this essential security control.
- Strict: Recommends 'Enabled'. The most secure configuration is to have this option enabled. Disabling it introduces an unnecessary security risk, therefore the strict recommendation is identical to the basic and moderate ones.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/var' filesystem is mounted with the 'nodev' option. The script should parse the output of 'findmnt -n -o OPTIONS /var'. It must return only the string 'true' if the 'nodev' option is present, and 'false' if it is not, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be 'enabled'. If the argument is 'enabled', the script must add the 'nodev' option to the '/var' partition's entry in '/etc/fstab' if it is not already present. It should then attempt to remount the '/var' partition to apply the setting immediately using 'mount -o remount /var'. The script must return the string 'true' upon successful completion or 'false' if it fails.

