# Ensure nodev option set on /var partition

Necessity: The `nodev` mount option prevents the interpretation of character or block special devices on a filesystem. The `/var` directory is intended for variable data like logs, caches, and spool files and should never contain device files. If an attacker gains write permissions to a directory within `/var`, they could create a malicious device file to attempt privilege escalation or gain raw access to system hardware, bypassing standard file permissions. Enforcing the `nodev` option on the `/var` partition mitigates this specific attack vector. Auditing and Remediation: The audit script verifies the live system configuration by checking the active mount options for the `/var` partition to see if `nodev` is present. The remediation script ensures this setting is persistent by modifying the `/etc/fstab` file to include the `nodev` option for the `/var` mount point. It then re-mounts the partition to apply the change without requiring a system reboot. Recommended State Rationale: Basic: ['Enabled'] - This is the minimum acceptable security posture, aligning with CIS Benchmarks and general security best practices. Moderate: ['Enabled'] - There is no effective intermediate state for this control; it is either secure (enabled) or insecure (disabled). Therefore, the moderate recommendation is the same as the basic one. Strict: ['Enabled'] - The strictest and only correct configuration for `/var` is to have `nodev` enabled, as there is no legitimate operational reason for this partition to host device files.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the mount options for the /var partition. The script must parse the output of the `mount` or `findmnt` command to determine if the `nodev` option is present. It should output 'Enabled' if the option is set, and 'Disabled' if it is not. The output must contain only this string value and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the `nodev` option to the /var partition entry in /etc/fstab, ensuring it is present. After modifying /etc/fstab, it must attempt to remount /var to apply the setting. If the argument is 'Disabled', it should remove the `nodev` option. The script must return `true` on successful application of the state and `false` on failure.

