✎ 1.1.15 Ensure nodev option set on /dev/shm partition (Scored) [SecScan]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== 1.1.15 Ensure nodev option set on /dev/shm partition (Scored) ======
=====Profile Applicability=====  
<code>
Level 1 - Server 
Level 1 - Workstation
</code>
=====Description=====
The ''nodev'' mount option specifies that the filesystem cannot contain special devices.
=====Rationale=====
Since the ''/dev/shm'' filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in ''/dev/shm'' partitions.
=====Audit===== 
Run the following command and verify that the ''nodev'' option is set on ''/dev/shm''.
<Code:bash>
# mount | grep /dev/shm 
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)
</Code>
=====Remediation===== 
Edit the ''/etc/fstab'' file and add ''nodev'' to the fourth field (mounting options) for the ''/dev/shm'' partition. See the ''fstab(5)'' manual page for more information.
Run the following command to remount ''/dev/shm'':
<Code:bash>
# mount -o remount,nodev /dev/shm
</Code>
=====Impact===== 
Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations.
=====Notes===== 
''/dev/shm'' is not specified in ''/etc/fstab'' despite being mounted by default. The following line will implement the recommended ''/dev/shm'' mount options in ''/etc/fstab'':
<code:bash>
tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0
</code>