mediumfilesystemverified ✓rollback-safe
Ensure noexec option on /var/tmp partition
mount-var-tmp-noexec · RHEL ≥ 8 · 1 impl
Description
The noexec mount option prevents execution of binaries on /var/tmp. This prevents attackers from executing malicious code.
Rationale
Preventing execution on /var/tmp blocks a common attack vector where malicious code is dropped and executed from world-writable directories.
Check → Remediate
Checkmount_option
- mount_point:
- /var/tmp
- options:
- noexec
Remediatemount_option_set
- mount_point:
- /var/tmp
- options:
- noexec
Framework references
CIS
rhel8 1.1.2.5.4rhel9 1.1.2.5.4rhel10 1.1.2.5.4
STIG
V-230522V-257877V-281246
NIST 800-53
CM-6AC-3AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#mount#var-tmp#hardening