← Rules Catalog
mediumfilesystemverified rollback-safe

Ensure noexec option on /var/tmp partition

mount-var-tmp-noexec · RHEL ≥ 8 · 1 impl

Description

The noexec mount option prevents execution of binaries on /var/tmp. This prevents attackers from executing malicious code.

Rationale

Preventing execution on /var/tmp blocks a common attack vector where malicious code is dropped and executed from world-writable directories.

Check → Remediate

Checkmount_option
mount_point:
/var/tmp
options:
noexec
Remediatemount_option_set
mount_point:
/var/tmp
options:
noexec

Framework references

CIS

rhel8 1.1.2.5.4rhel9 1.1.2.5.4rhel10 1.1.2.5.4

STIG

V-230522V-257877V-281246

NIST 800-53

CM-6AC-3AC-6

Live verification

rhel10:checkrhel8:checkrhel9:check
#mount#var-tmp#hardening