cyberstrikeus 1.1.7 Ensure noexec option set on /var partition (Automated)
Description
The noexec mount option specifies that the filesystem cannot contain executable binaries.
Rationale
Since the /var filesystem is only intended for services to write data and not execute, set this option to ensure that users cannot run executable binaries from /var.
Audit Procedure
Verify that the noexec option is set if a /var partition exists.
Run the following command and verify that nothing is returned:
# mount | grep -E '\s/var\s' | grep -v noexec
Expected Result
The command should return no output, confirming that the noexec option is set on the /var partition.
Remediation
Run the following command to remount /var:
# mount -o remount,noexec /var
Note: /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 2.3 Address Unauthorized Software - Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently. | x | x | x |
| v7 | 2.6 Address unapproved software - Ensure that unauthorized software is either removed or the inventory is updated in a timely manner. | x | x | x |
Profile
Level 2 - Server | Automated