Description
The nosuid mount option can be used to prevent
execution of setuid programs in /tmp. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the nosuid option to the list of
Options in the systemd.mount unit that
controls mounting of
/tmp.
Rationale
The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.
- ID
xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
- References
CSC: Critical Security Controls
COBIT®: Control Objectives for Information and Related Technologies
CCI: Control Correlation Identifier
ISA-62443-2-1-2009, Security for Industrial Automation and Control Systems Part 2-1: Establishing an Industrial Automation and Control Systems Security Program
ANSI/ISA-62443-3-3 (99.03.03)-2013 Security for industrial automation and control systems Part 3-3: System security requirements and security levels
CIP: Critical Infrastructure Protection
NIST Special Publication 800-53 (Revision 4): Security and Privacy Controls for Federal Information Systems and Organizations
Framework for Improving Critical Infrastructure Cybersecurity
GPOS SRG: General Purpose Operating System Security Requirements Guide