Add noexec Option to /var/log/audit
An XCCDF Rule
Description
The noexec mount option can be used to prevent binaries
from being executed out of /var/log/audit.
Add the noexec option to the list of
Options in the systemd.mount unit that
controls mounting of
/var/log/audit.
Rationale
Allowing users to execute binaries from directories containing audit log files
such as /var/log/audit should never be necessary in normal operation and
can expose the system to potential compromise.
- ID
- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec
- Severity
- Medium
- References
- Updated