Add nodev Option to /var/tmp
Description
The nodev mount option can be used to prevent device files from
being created in /var/tmp. Legitimate character and block devices
should not exist within temporary directories like /var/tmp.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp.
Rationale
The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && findmnt --kernel "/var/tmp" > /dev/null || findmnt --fstab "/var/tmp" > /dev/null ); then
function perform\_remediation {
mount\_point\_match\_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/tmp")"
grep "$mount\_point\_match\_regexp" -q /etc/fstab \
|| { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" >&2; return 1; }
mount\_point\_match\_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/tmp)"
# If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
if ! grep "$mount\_point\_match\_regexp" /etc/fstab; then
# runtime opts without some automatic kernel/userspace-added defaults
previous\_mount\_opts=$(grep "$mount\_point\_match\_regexp" /etc/mtab | head -1 | awk '{print $4}' \
| sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
[ "$previous\_mount\_opts" ] && previous\_mount\_opts+=","
echo " /var/tmp defaults,${previous\_mount\_opts}nodev 0 0" >> /etc/fstab
# If the mount\_opt option is not already in the mount point's /etc/fstab entry, add it
elif ! grep "$mount\_point\_match\_regexp" /etc/fstab | grep "nodev"; then
previous\_mount\_opts=$(grep "$mount\_point\_match\_regexp" /etc/fstab | awk '{print $4}')
sed -i "s|\(${mount\_point\_match\_regexp}.\*${previous\_mount\_opts}\)|\1,nodev|" /etc/fstab
fi
if mkdir -p "/var/tmp"; then
if mountpoint -q "/var/tmp"; then
mount -o remount --target "/var/tmp"
fi
fi
}
perform\_remediation
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: 'Add nodev Option to /var/tmp: Check information associated to mountpoint'
command: findmnt --fstab '/var/tmp'
register: device\_name
failed\_when: device\_name.rc > 1
changed\_when: false
when: ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman",
"container"] and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list
)
tags:
- configure\_strategy
- high\_disruption
- low\_complexity
- medium\_severity
- mount\_option\_var\_tmp\_nodev
- no\_reboot\_needed
- name: 'Add nodev Option to /var/tmp: Create mount\_info dictionary variable'
set\_fact:
mount\_info: '{{ mount\_info|default({})|combine({item.0: item.1}) }}'
with\_together:
- '{{ device\_name.stdout\_lines[0].split() | list | lower }}'
- '{{ device\_name.stdout\_lines[1].split() | list }}'
when:
- ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
- device\_name.stdout is defined and device\_name.stdout\_lines is defined
- (device\_name.stdout | length > 0)
tags:
- configure\_strategy
- high\_disruption
- low\_complexity
- medium\_severity
- mount\_option\_var\_tmp\_nodev
- no\_reboot\_needed
- name: 'Add nodev Option to /var/tmp: If /var/tmp not mounted, craft mount\_info manually'
set\_fact:
mount\_info: '{{ mount\_info|default({})|combine({item.0: item.1}) }}'
with\_together:
- - target
- source
- fstype
- options
- - /var/tmp
- ''
- ''
- defaults
when:
- ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
- ("--fstab" | length == 0)
- (device\_name.stdout | length == 0)
tags:
- configure\_strategy
- high\_disruption
- low\_complexity
- medium\_severity
- mount\_option\_var\_tmp\_nodev
- no\_reboot\_needed
- name: 'Add nodev Option to /var/tmp: Make sure nodev option is part of the to /var/tmp
options'
set\_fact:
mount\_info: '{{ mount\_info | combine( {''options'':''''~mount\_info.options~'',nodev''
}) }}'
when:
- ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
- mount\_info is defined and "nodev" not in mount\_info.options
tags:
- configure\_strategy
- high\_disruption
- low\_complexity
- medium\_severity
- mount\_option\_var\_tmp\_nodev
- no\_reboot\_needed
- name: 'Add nodev Option to /var/tmp: Ensure /var/tmp is mounted with nodev option'
mount:
path: /var/tmp
src: '{{ mount\_info.source }}'
opts: '{{ mount\_info.options }}'
state: mounted
fstype: '{{ mount\_info.fstype }}'
when:
- ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
- (device\_name.stdout is defined and (device\_name.stdout | length > 0)) or ("--fstab"
| length == 0)
tags:
- configure\_strategy
- high\_disruption
- low\_complexity
- medium\_severity
- mount\_option\_var\_tmp\_nodev
- no\_reboot\_needed
