1.1.4 Set noexec option for /tmp Partition

Information

The noexec mount option specifies that the filesystem cannot contain executable binaries.

Rationale:

Since the tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /tmp.

Solution

Edit the /etc/fstab file and add noexec to the fourth field (mounting options). See the fstab(5) manual page for more information.

# mount -o remount,noexec /tmp

See Also

https://workbench.cisecurity.org/files/3096

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-11, CSCv6|3.1, CSCv7|2.6

Plugin: Unix

Control ID: 2a36780781e4ca74be4d6820bc162cd873e4aee7dd4518e1c6a61d81f9e70915