Add nosuid Option to /var/tmp
An XCCDF Rule
Description
The nosuid mount option can be used to prevent
execution of setuid programs in /var/tmp. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the nosuid option to the list of
Options in the systemd.mount unit that
controls mounting of
/var/tmp.
Rationale
The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.
- ID
- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
- Severity
- Medium
- References
- Updated