# Ensure nodev option set on /home partition

The `nodev` (no devices) mount option prevents the interpretation of character or block special devices on the specified partition. Necessity: Setting `nodev` on the /home partition is a critical security measure to prevent privilege escalation. Without this option, a malicious user could create a device file in their home directory (e.g., pointing to `/dev/sda`) and use it to access raw disk data, potentially bypassing file permissions and gaining unauthorized access to sensitive system information. Auditing and Remediation: The audit script checks the currently active mount options for the /home partition to verify if `nodev` is present. The remediation script ensures this state by modifying the persistent filesystem configuration in `/etc/fstab` to include the `nodev` option and then remounting the partition to apply the change immediately. Recommended State Rationale: Basic, Moderate, and Strict levels all recommend the `['nodev']` state. This is a binary security control; it is either enforced or it is not. There is no intermediate state that provides partial protection. Its enforcement is a standard recommendation in security benchmarks like CIS because it directly mitigates a known attack vector with no negative impact on standard user operations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['nodev']` |
| **Moderate** | `['nodev']` |
| **Strict** | `['nodev']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the mount options for the /home partition. The script must output `nodev` if the option is currently set for the live mount, and `not_set` if it is not. The output must not contain any other text, labels, or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: `set`. The script must modify the `/etc/fstab` file to add the `nodev` option to the mount options for the `/home` partition. If `/home` is not a separate partition, the script should do nothing. After updating the file, it must remount `/home` to apply the setting immediately. The script must return `true` on success and `false` on failure.

