mediumfilesystemverified ✓

Ensure /tmp is on a separate filesystem

mount-tmp-separate-fs · RHEL ≥ 8 · 1 impl

Description

The /tmp directory must be on a separate filesystem or logical volume. Using a dedicated partition for /tmp prevents temporary files from filling the root filesystem and allows separate mount option enforcement.

Rationale

Without a separate /tmp filesystem, an attacker who fills /tmp can crash the operating system or prevent new logins. A separate partition also allows noexec and nosuid mount options to be enforced.

Check → Remediate

Checkcommand

findmnt /tmp 2>/dev/null | grep -v '^TARGET' | awk '{print $1}' | grep -q '/tmp'

expected_exit:: 0

Remediatemanual

note:: Create a separate partition or logical volume for /tmp and add it to /etc/fstab. Alternatively, configure systemd-tmpfiles or use a tmpfs mount: echo 'tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec 0 0' >> /etc/fstab then mount -a.

Framework references

CIS

rhel9 1.1.2.1.1rhel8 1.1.2.1.1rhel10 1.1.2.1.1

STIG

V-280938 / RHEL-10-000540V-230295

NIST 800-53

CM-6SC-5

Live verification

rhel8:checkrhel9:check

#mount#tmp#filesystem#hardening