mediumfilesystemverified ✓rollback-safe
Ensure noexec option on /dev/shm partition
mount-dev-shm-noexec · RHEL ≥ 8 · 1 impl
Description
The noexec mount option prevents execution of binaries on /dev/shm. This prevents attackers from executing code from shared memory.
Rationale
Shared memory is sometimes used by attackers to stage and execute malicious code. Preventing execution blocks this attack vector.
Check → Remediate
Checkmount_option
- mount_point:
- /dev/shm
- options:
- noexec
Remediatemount_option_set
- mount_point:
- /dev/shm
- options:
- noexec
Framework references
CIS
rhel8 1.1.2.2.4rhel9 1.1.2.2.4rhel10 1.1.2.2.4
STIG
V-230510V-257864V-281236
NIST 800-53
CM-6AC-3AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#dev-shm#hardening