cyberstrikeus 1.1.4 Ensure nosuid option set on /tmp partition (Automated)
Description
The nosuid mount option specifies that the filesystem cannot contain setuid files.
Rationale
Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot create setuid files in /tmp.
Audit Procedure
Verify that the nosuid option is set if a /tmp partition exists.
Run the following command and verify that nothing is returned:
# mount | grep -E '\s/tmp\s' | grep -v nosuid
Expected Result
The command should return no output, confirming that the nosuid option is set on the /tmp partition.
Remediation
Run the following command to remount /tmp:
# mount -o remount,nosuid /tmp
Note: /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | x | x | x |
| v7 | 5.1 Establish Secure Configurations - Maintain documented, standard security configuration standards for all authorized operating systems and software. | x | x | x |
Profile
Level 1 - Server | Automated