1.1.15 Ensure nodev option set on /dev/shm partition (Scored)

Level 1 - Server 
Level 1 - Workstation

The nodev mount option specifies that the filesystem cannot contain special devices.

Since the /dev/shm filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in /dev/shm partitions.

Run the following command and verify that the nodev option is set on /dev/shm.

# mount | grep /dev/shm 
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)

Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the /dev/shm partition. See the fstab(5) manual page for more information. Run the following command to remount /dev/shm:

# mount -o remount,nodev /dev/shm

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.

/dev/shm is not specified in /etc/fstab despite being mounted by default. The following line will implement the recommended /dev/shm mount options in /etc/fstab:

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0