Profile Applicability:
 • Level 1

Description:
 The nodev mount option prevents device files from being interpreted on the mounted filesystem. Applying this option to /var/tmp restricts the creation and use of device files in this temporary directory, reducing security risks.

Rationale:
 Setting the nodev option on /var/tmp mitigates risks associated with device file exploitation, which could lead to privilege escalation or unauthorized system access.

Impact:
 Pros:

  • Prevents device file abuse on /var/tmp.

  • Improves overall system security posture.

Cons:

  • May affect rare legitimate use cases requiring device files in /var/tmp.

Default Value:
 By default, nodev is usually not set on /var/tmp unless explicitly configured.

Pre-requisites:

  • Root or sudo privileges to modify /etc/fstab and remount filesystems.

  • /var/tmp must be mounted as a separate partition.

Remediation:

Test Plan:

Using Linux command line:

  1. Check current mount options for /var/tmp:

     mount | grep /var/tmp

  2. Verify if nodev is present in /etc/fstab for /var/tmp:

     grep /var/tmp /etc/fstab
    Expected output: Mount options for /var/tmp include nodev.


Implementation Plan:

Using Linux command line:

  1. Edit /etc/fstab to add nodev to the /var/tmp mount options. Example:
    /dev/<partition>  /var/tmp  ext4  defaults,nodev,nosuid,noexec  0  0

  2. Remount /var/tmp with new options without reboot:

     mount -o remount,nodev /var/tmp

  3. Verify mount options:

     mount | grep /var/tmp

Backout Plan:

Using Linux command line:

  1. Remove nodev from /var/tmp mount options in /etc/fstab.

  2. Remount /var/tmp without nodev:

     mount -o remount /var/tmp

  3. Verify mount options:

     mount | grep /var/tmp

References: