mediumfilesystemverified ✓rollback-safe
Ensure noexec option on /tmp partition
mount-tmp-noexec · RHEL ≥ 8 · 1 impl
Description
The noexec mount option prevents execution of binaries on the /tmp filesystem. This prevents attackers from executing malicious code placed in /tmp.
Rationale
Attackers often drop and execute malicious binaries in /tmp because it is world-writable. Preventing execution blocks this attack vector.
Check → Remediate
Checkmount_option
- mount_point:
- /tmp
- options:
- noexec
Remediatemount_option_set
- mount_point:
- /tmp
- options:
- noexec
Framework references
CIS
rhel8 1.1.2.1.4rhel9 1.1.2.1.4rhel10 1.1.2.1.4
STIG
V-230513V-257867V-281239
NIST 800-53
CM-6AC-3AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#tmp#hardening