Add nosuid Option to /var
An XCCDF Rule
Description
The nosuid mount option can be used to prevent
execution of setuid programs in /var. The SUID and SGID permissions
should not be required for this directory.
Add the nosuid option to the list of
Options in the systemd.mount unit that
controls mounting of
/var.
Rationale
The presence of SUID and SGID executables should be tightly controlled.
- ID
- xccdf_org.ssgproject.content_rule_mount_option_var_nosuid
- Severity
- Medium
- References
- Updated