# Ensure nosuid option set on /var/tmp partition

Necessity: The '/var/tmp' directory is a world-writable location where users can store temporary files. An attacker could place a malicious SUID (Set User ID) executable in this directory. If another user, including root, were to execute this file, it would run with the privileges of the file's owner, potentially leading to privilege escalation. Mounting the '/var/tmp' partition with the 'nosuid' option prevents SUID bits from having any effect, mitigating this significant security risk.

Auditing and Remediation: The audit script verifies the active mount options for the '/var/tmp' filesystem to confirm if 'nosuid' is currently enforced. The remediation script modifies the '/etc/fstab' file to make the 'nosuid' option persistent across reboots and then remounts the partition to apply the setting immediately without requiring a system restart.

Recommended State Rationale: 
Basic: ['Enabled'] - This is the fundamental security recommendation according to benchmarks like CIS. Disabling SUID executables in a world-writable directory is a critical first step in hardening a system against local privilege escalation attacks.
Moderate: ['Enabled'] - There is no effective intermediate state. The protection afforded by 'nosuid' is binary; it is either active or it is not. Therefore, a moderate security posture maintains this essential setting.
Strict: ['Enabled'] - For a maximally secure system, enabling 'nosuid' on '/var/tmp' is non-negotiable. Any deviation from this state introduces an unacceptable attack vector. All hardening levels converge on enabling this option as the only secure configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the '/var/tmp' partition is mounted with the 'nosuid' option. The script should parse the output of 'findmnt -n -o OPTIONS /var/tmp' or equivalent command. It must return only the string 'true' if the 'nosuid' option is present, and 'false' otherwise, with no extra text.

## Remediation Script Working

Bash script that accepts one positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must add the 'nosuid' option to the '/var/tmp' entry in '/etc/fstab'. If '/var/tmp' is not a separate partition, the script should take no action but report success. After updating '/etc/fstab', it should remount '/var/tmp' using 'mount -o remount /var/tmp'. If the argument is 'disabled', it should remove the option. The script must return 'true' on success and 'false' on failure.

