# Ensure noexec option set on /var/log/audit partition

Necessity: The 'noexec' mount option prevents binary executables from being run from a specific filesystem partition. The /var/log/audit directory is designated exclusively for storing system audit logs. There is no legitimate reason for any executable files to reside in or be run from this location. If an attacker gains write access to this directory and it is not configured with 'noexec', they could upload and execute malicious code, potentially escalating privileges or establishing persistence. Enforcing 'noexec' is a critical defense-in-depth measure that adheres to the principle of least privilege, reducing the partition's attack surface.

Auditing and Remediation: The audit script checks the live mount settings for the partition containing /var/log/audit to verify if the 'noexec' flag is active. The remediation script automates the process of editing the /etc/fstab file, which controls persistent mount options at boot time. It adds or removes the 'noexec' option for the /var/log/audit entry and then uses the 'mount' command to apply the change to the live system without requiring a reboot.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Enabled'. This is because the security benefit is binary; the partition either allows execution or it does not. Basic: Setting 'noexec' is a fundamental security hardening step recommended by standards like the CIS Benchmarks. Moderate: There is no middle ground for this control. Allowing execution from a log partition is a significant security risk, making 'Enabled' the only acceptable moderate configuration. Strict: The strictest and only secure configuration is to have 'noexec' enabled, completely mitigating the threat of code execution from this partition.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the mount options for the partition hosting the /var/log/audit directory. The script must determine if the 'noexec' option is set for this partition. If the 'noexec' option is present, the script must output the string 'Enabled'. If the option is not present, it must output 'Disabled'. The script's output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

bash script that accepts a single positional command-line argument, which will be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must modify the /etc/fstab entry for the /var/log/audit partition to include the 'noexec' option and then remount the partition to apply the setting immediately. If the argument is 'Disabled', it should remove the 'noexec' option. The script must return 'true' on successful modification or if the state is already correct, and 'false' on failure.

