mediumfilesystemverified ✓rollback-safe
Ensure nosuid option on /dev/shm partition
mount-dev-shm-nosuid · RHEL ≥ 8 · 1 impl
Description
The nosuid mount option prevents setuid/setgid bits from being honored on /dev/shm. This prevents privilege escalation via shared memory.
Rationale
Setuid programs in shared memory could be used for privilege escalation attacks.
Check → Remediate
Checkmount_option
- mount_point:
- /dev/shm
- options:
- nosuid
Remediatemount_option_set
- mount_point:
- /dev/shm
- options:
- nosuid
Framework references
CIS
rhel8 1.1.2.2.3rhel9 1.1.2.2.3rhel10 1.1.2.2.3
STIG
V-230509V-257865V-281237
NIST 800-53
CM-6AC-3AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#dev-shm#hardening