mediumfilesystemverified ✓

Ensure /dev/shm is a separate partition

mount-dev-shm-separate-fs · RHEL ≥ 8 · 1 impl

Description

The /dev/shm shared-memory directory must be mounted as its own filesystem (a tmpfs entry), separate from the root filesystem, so that restrictive mount options can be enforced on it independently.

Rationale

A dedicated /dev/shm mount lets nodev, nosuid, and noexec be applied to shared memory, closing an execution and privilege-escalation vector. Without a separate mount those options cannot be reliably enforced.

Check → Remediate

Checkcommand

findmnt --kernel /dev/shm -n -o FSTYPE 2>/dev/null | grep -qx tmpfs

expected_exit:: 0

Remediatemanual

note:: Ensure /dev/shm is mounted as a dedicated tmpfs filesystem. On a default RHEL install this is present; if absent, add 'tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0' to /etc/fstab and run 'mount -a'.

Framework references

CIS

rhel9 1.1.2.2.1rhel8 1.1.2.2.1rhel10 1.1.2.2.1

NIST 800-53

CM-6SC-5

Live verification

rhel9:check

#mount#dev-shm#filesystem#hardening