# Ensure noexec option set on /var/log partition

Necessity: The /var/log directory is designated for storing system and application log files, which are text-based and should never be executed. Allowing execution from this partition creates a significant security risk. If an attacker finds a vulnerability that allows them to write to a log file (e.g., poisoning log entries with malicious code), they could potentially execute that code to escalate privileges or compromise the system. Setting the `noexec` mount option prevents the kernel from executing any binaries on that partition, effectively mitigating this attack vector. It is a critical defense-in-depth measure.

Auditing and Remediation: The audit script inspects the currently active mount options for the /var/log partition to verify if the `noexec` flag is set. The remediation script modifies the `/etc/fstab` file to ensure the `noexec` option is persistently applied across reboots and then remounts the partition to enforce the setting on the live system.

Recommended State Rationale: 
Basic, Moderate, and Strict: The recommended state for all hardening levels is 'Enabled'. There is no legitimate operational reason for binaries to be executed from a log directory. Disabling execution is a fundamental security best practice with no performance or functionality trade-offs for this specific partition type. Therefore, this setting is considered a mandatory baseline for any securely configured system, and the recommendation does not vary between levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the mount options for the /var/log partition. The script should parse the output of `findmnt --noheadings --output OPTIONS /var/log`. If the `noexec` option is present in the comma-separated list of options, the script must return the string 'Enabled'. If the option is not present, it must return 'Disabled'. If /var/log is not a separate partition, it should also return 'Disabled'. The script must not return any other text or formatting.

## Remediation Script Working

bash script that takes a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must locate the entry for the /var/log mount point in /etc/fstab and add the `noexec` option to its mount options, handling existing options correctly. If the argument is 'Disabled', it must remove the `noexec` option. After updating /etc/fstab, the script must remount the partition using `mount -o remount /var/log` to apply the changes immediately. The script must return `true` on success and `false` on failure, including if /var/log is not a separate partition.

