← Rules Catalog
mediumfilesystemverified rollback-safe

Ensure noexec option on /dev/shm partition

mount-dev-shm-noexec · RHEL ≥ 8 · 1 impl

Description

The noexec mount option prevents execution of binaries on /dev/shm. This prevents attackers from executing code from shared memory.

Rationale

Shared memory is sometimes used by attackers to stage and execute malicious code. Preventing execution blocks this attack vector.

Check → Remediate

Checkmount_option
mount_point:
/dev/shm
options:
noexec
Remediatemount_option_set
mount_point:
/dev/shm
options:
noexec

Framework references

CIS

rhel8 1.1.2.2.4rhel9 1.1.2.2.4rhel10 1.1.2.2.4

STIG

V-230510V-257864V-281236

NIST 800-53

CM-6AC-3AC-6

Live verification

rhel10:checkrhel8:checkrhel9:check
#mount#dev-shm#hardening