# Ensure nodev option set on /var/tmp partition

Necessity: The 'nodev' mount option prevents the interpretation of character or block special devices on the /var/tmp partition. Since /var/tmp is a world-writable directory, an attacker could otherwise create a malicious device file and use it to gain unauthorized access to system hardware, potentially leading to privilege escalation or a system compromise. Enforcing 'nodev' is a critical defense-in-depth measure that mitigates this risk by ensuring that device files placed in /var/tmp are not functional. Auditing and Remediation: The audit script verifies the current mount options for /var/tmp by querying the system's filesystem table to check for the presence of the 'nodev' flag. The remediation script directly modifies the system's filesystem configuration file (/etc/fstab) to persistently add the 'nodev' option to the /var/tmp mount point and then triggers a remount to apply the change without requiring a reboot. Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is 'Enabled'. This is a non-negotiable security setting recommended by benchmarks like CIS. There is no valid security reason to allow device interpretation on a world-writable temporary directory. The performance impact is negligible, while the security benefit is significant. Therefore, a single, strict recommendation is applied across all levels to ensure a secure baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the mount options for the /var/tmp partition. The script must check if the 'nodev' option is present for the /var/tmp mount point. It should output 'Enabled' if the option is found, and 'Disabled' if it is not. The script's output must consist solely of one of these two strings.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the 'nodev' option to the /var/tmp entry in /etc/fstab and remount the filesystem to apply the change. If the argument is 'Disabled', it must remove the 'nodev' option. The script must return 'true' upon successful modification and 'false' if it fails, such as if /var/tmp is not a separate partition.

