mediumfilesystemverified ✓rollback-safe
Set mount options on /var/log
mount-var-log-options · RHEL ≥ 8 · 1 impl
Description
The /var/log partition should have nodev, nosuid, and noexec mount options set to prevent device files, setuid binaries, and executable files in the log directory.
Rationale
Restrictive mount options on /var/log prevent execution of malicious code that might be placed in or disguised as log files and limit privilege escalation vectors.
Check → Remediate
Checkcomposed · 3 sub-checks (all must pass)
- 1. mount_option:
- mount_point=/var/log options=nodev
- 2. mount_option:
- mount_point=/var/log options=nosuid
- 3. mount_option:
- mount_point=/var/log options=noexec
Remediatemount_option_set
- mount_point:
- /var/log
- options:
- nodev, nosuid, noexec
Framework references
CIS
rhel9 1.1.2.6.2rhel9 1.1.2.6.3rhel9 1.1.2.6.4rhel10 1.1.2.6.2rhel10 1.1.2.6.3rhel10 1.1.2.6.4rhel8 1.1.2.6.2rhel8 1.1.2.6.3rhel8 1.1.2.6.4
STIG
V-230514 / RHEL-08-040126V-230515 / RHEL-08-040127V-230516 / RHEL-08-040128V-257870 / RHEL-09-231145V-257871 / RHEL-09-231150V-257872 / RHEL-09-231155V-281242 / RHEL-10-700170V-281243 / RHEL-10-700175V-281244 / RHEL-10-700180
NIST 800-53
AC-6CM-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#logging#security