cyberstrikeus 1.1.10 Ensure nodev option set on /dev/shm partition (Automated)
Description
The nodev mount option specifies that the filesystem cannot contain special devices.
Rationale
Since the /dev/shm filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in /dev/shm partitions.
Audit Procedure
Verify that the nodev option is set if a /dev/shm partition exists.
Run the following command and verify that nothing is returned:
# mount | grep -E '\s/dev/shm\s' | grep -v nodev
Expected Result
The command should return no output, confirming that the nodev option is set on the /dev/shm partition.
Remediation
Run the following command to remount /dev/shm:
# mount -o remount,nodev /dev/shm
Note: /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | x | x | x |
| v7 | 5.1 Establish Secure Configurations - Maintain documented, standard security configuration standards for all authorized operating systems and software. | x | x | x |
Profile
Level 1 - Server | Automated