← Rules Catalog
mediumfilesystemverified rollback-safe

Ensure nosuid option on /tmp partition

mount-tmp-nosuid · RHEL ≥ 8 · 1 impl

Description

The nosuid mount option prevents setuid and setgid bits from being honored on the /tmp filesystem. This prevents privilege escalation via setuid programs.

Rationale

Allowing setuid programs on /tmp could allow an attacker to create malicious setuid programs that escalate privileges when executed by other users.

Check → Remediate

Checkmount_option
mount_point:
/tmp
options:
nosuid
Remediatemount_option_set
mount_point:
/tmp
options:
nosuid

Framework references

CIS

rhel8 1.1.2.1.3rhel9 1.1.2.1.3rhel10 1.1.2.1.3

STIG

V-230512V-257868V-281240

NIST 800-53

CM-6AC-3AC-6

Live verification

rhel10:checkrhel8:checkrhel9:check
#mount#tmp#hardening