mediumfilesystemverified ✓rollback-safe
Set mount options on /var
mount-var-options · RHEL ≥ 8 · 1 impl
Description
The /var partition should have nodev mount option set to prevent device files in the /var directory tree.
Rationale
The /var filesystem contains variable data including logs and caches. The nodev option prevents interpretation of block or character special devices, reducing potential attack vectors.
Check → Remediate
Checkmount_option
- mount_point:
- /var
- options:
- nodev
Remediatemount_option_set
- mount_point:
- /var
- options:
- nodev
Framework references
CIS
rhel9 1.1.2.4.2rhel10 1.1.2.4.2rhel8 1.1.2.4.2
STIG
V-257869 / RHEL-09-231140V-281241 / RHEL-10-700165
NIST 800-53
AC-6CM-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#var#security