# Ensure nosuid option set on /tmp partition

Necessity: The 'nosuid' (no set-user-identifier) mount option prevents SUID and SGID bits from taking effect on executables within a filesystem. Since the /tmp directory is typically world-writable, it is a common target for attackers to place malicious programs. If an attacker uploads an executable with the SUID bit set to /tmp, and the partition is not mounted with 'nosuid', they could execute it to gain the privileges of the file's owner (often root). Enforcing 'nosuid' on /tmp is a critical hardening step that mitigates this common privilege escalation vector.

Auditing and Remediation: The audit script directly queries the system's active mount points to verify if the 'nosuid' flag is currently enforced for the /tmp partition. The remediation script modifies the '/etc/fstab' file to ensure the setting persists across reboots and then remounts the partition to apply the change to the live system.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Enabled'. This is a binary, non-negotiable security control. There is no valid operational reason to allow SUID executables in a world-writable temporary directory. Its implementation provides a significant security benefit with negligible performance impact. All major security benchmarks, including CIS, mandate this setting as a fundamental baseline requirement for system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the '/tmp' partition is mounted with the 'nosuid' option. The script should use a command like 'findmnt' to inspect the mount options. It must output only 'Enabled' if the option is present, or 'Disabled' if it is not, with no other text or formatting.

## Remediation Script Working

shell script that accepts one positional argument ('Enabled'). If the argument is 'Enabled', the script must add the 'nosuid' option to the '/tmp' entry in '/etc/fstab' if it doesn't already exist, and then execute 'mount -o remount /tmp' to apply the setting immediately. The script must return 'true' on success and 'false' on failure.

