mediumfilesystemverified ✓rollback-safe
Ensure nosuid option on /tmp partition
mount-tmp-nosuid · RHEL ≥ 8 · 1 impl
Description
The nosuid mount option prevents setuid and setgid bits from being honored on the /tmp filesystem. This prevents privilege escalation via setuid programs.
Rationale
Allowing setuid programs on /tmp could allow an attacker to create malicious setuid programs that escalate privileges when executed by other users.
Check → Remediate
Checkmount_option
- mount_point:
- /tmp
- options:
- nosuid
Remediatemount_option_set
- mount_point:
- /tmp
- options:
- nosuid
Framework references
CIS
rhel8 1.1.2.1.3rhel9 1.1.2.1.3rhel10 1.1.2.1.3
STIG
V-230512V-257868V-281240
NIST 800-53
CM-6AC-3AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#tmp#hardening