mediumfilesystemverified ✓

Ensure /var/tmp is on a separate filesystem

mount-var-tmp-separate-fs · RHEL ≥ 8 · 1 impl

Description

The /var/tmp directory must be on a separate filesystem or logical volume. A dedicated partition for /var/tmp prevents temporary files from consuming the /var filesystem and allows enforcement of separate mount options.

Rationale

Without a separate /var/tmp filesystem, an attacker filling /var/tmp can cause system instability. A separate partition allows noexec and nosuid options to be enforced independently of /var.

Check → Remediate

Checkcommand

findmnt /var/tmp 2>/dev/null | grep -v '^TARGET' | awk '{print $1}' | grep -q '/var/tmp'

expected_exit:: 0

Remediatemanual

note:: Create a separate partition or logical volume for /var/tmp and add it to /etc/fstab with nodev, nosuid, and noexec options.

Framework references

CIS

rhel9 1.1.2.5.1rhel10 1.1.2.5.1rhel8 1.1.2.5.1

STIG

V-280941 / RHEL-10-000570V-257848 / RHEL-09-231035V-244529

NIST 800-53

CM-6SC-5

Live verification

rhel10:checkrhel8:checkrhel9:check

#mount#var-tmp#filesystem#hardening