# Ensure noexec option set on /var/tmp partition

Necessity: The /var/tmp directory is a world-writable location for temporary files that persist across reboots. Attackers can exploit this by placing malicious scripts or binaries in /var/tmp and executing them to escalate privileges or establish persistence. Setting the 'noexec' mount option prevents any programs from being executed from this filesystem, mitigating a common attack vector by ensuring that data written to this location cannot be run as code. Misconfiguration leaves the system vulnerable to malware execution from a predictable, writable location. Auditing and Remediation: The audit script inspects the current mount options for the /var/tmp partition to verify if 'noexec' is active. The remediation script modifies the system's filesystem table (/etc/fstab) to make the 'noexec' option persistent across reboots and then remounts the partition to apply the setting immediately. Recommended State Rationale: Basic: ['noexec'] - This is the fundamental security requirement as recommended by benchmarks like CIS. It directly prevents the execution of arbitrary code from a high-risk directory. Moderate: ['noexec'] - There is no effective intermediate state for this control. The security benefit is binary; execution is either permitted or denied. Therefore, the moderate recommendation aligns with the basic level. Strict: ['noexec'] - The strictest and most secure configuration is to enforce the 'noexec' option. In high-security environments, this is a non-negotiable setting for temporary file partitions, often combined with 'nosuid' and 'nodev' for a defense-in-depth approach.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['noexec']` |
| **Moderate** | `['noexec']` |
| **Strict** | `['noexec']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'noexec' option is set for the /var/tmp partition. The script should parse the output of the `findmnt -n -o OPTIONS /var/tmp` command. If 'noexec' is present in the options list, it should output 'noexec'. If it is not present, it should output 'exec'. The script must not return any other text or formatting.

## Remediation Script Working

Bash script that configures the mount options for the /var/tmp partition. The script must accept one positional argument: 'noexec' or 'exec'. If the argument is 'noexec', the script should add the 'noexec' option to the /var/tmp entry in /etc/fstab and remount the partition with the new option. If the argument is 'exec', it should remove the 'noexec' option. The script must handle cases where /var/tmp is on a separate partition. Upon successful application of the new setting, the script must return 'true'; otherwise, it should return 'false'.

