Add nodev Option to /var/tmp

Classification:

compliance

Framework:

Control:

Description

The nodev mount option can be used to prevent device files from being created in /var/tmp. Legitimate character and block devices should not exist within temporary directories like /var/tmp. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /var/tmp.

Rationale

The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && findmnt --kernel "/var/tmp" > /dev/null || findmnt --fstab "/var/tmp" > /dev/null ); then

function perform\_remediation {
 
 mount\_point\_match\_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/tmp")"

 grep "$mount\_point\_match\_regexp" -q /etc/fstab \
 || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
 echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" >&2; return 1; }
 


 mount\_point\_match\_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/tmp)"

 # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
 if ! grep "$mount\_point\_match\_regexp" /etc/fstab; then
 # runtime opts without some automatic kernel/userspace-added defaults
 previous\_mount\_opts=$(grep "$mount\_point\_match\_regexp" /etc/mtab | head -1 | awk '{print $4}' \
 | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
 [ "$previous\_mount\_opts" ] && previous\_mount\_opts+=","
 echo " /var/tmp defaults,${previous\_mount\_opts}nodev 0 0" >> /etc/fstab
 # If the mount\_opt option is not already in the mount point's /etc/fstab entry, add it
 elif ! grep "$mount\_point\_match\_regexp" /etc/fstab | grep "nodev"; then
 previous\_mount\_opts=$(grep "$mount\_point\_match\_regexp" /etc/fstab | awk '{print $4}')
 sed -i "s|\(${mount\_point\_match\_regexp}.\*${previous\_mount\_opts}\)|\1,nodev|" /etc/fstab
 fi


 if mkdir -p "/var/tmp"; then
 if mountpoint -q "/var/tmp"; then
 mount -o remount --target "/var/tmp"
 fi
 fi
}

perform\_remediation

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: 'Add nodev Option to /var/tmp: Check information associated to mountpoint'
 command: findmnt --fstab '/var/tmp'
 register: device\_name
 failed\_when: device\_name.rc > 1
 changed\_when: false
 when: ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman",
 "container"] and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list
 )
 tags:
 - configure\_strategy
 - high\_disruption
 - low\_complexity
 - medium\_severity
 - mount\_option\_var\_tmp\_nodev
 - no\_reboot\_needed

- name: 'Add nodev Option to /var/tmp: Create mount\_info dictionary variable'
 set\_fact:
 mount\_info: '{{ mount\_info|default({})|combine({item.0: item.1}) }}'
 with\_together:
 - '{{ device\_name.stdout\_lines[0].split() | list | lower }}'
 - '{{ device\_name.stdout\_lines[1].split() | list }}'
 when:
 - ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
 - device\_name.stdout is defined and device\_name.stdout\_lines is defined
 - (device\_name.stdout | length > 0)
 tags:
 - configure\_strategy
 - high\_disruption
 - low\_complexity
 - medium\_severity
 - mount\_option\_var\_tmp\_nodev
 - no\_reboot\_needed

- name: 'Add nodev Option to /var/tmp: If /var/tmp not mounted, craft mount\_info manually'
 set\_fact:
 mount\_info: '{{ mount\_info|default({})|combine({item.0: item.1}) }}'
 with\_together:
 - - target
 - source
 - fstype
 - options
 - - /var/tmp
 - ''
 - ''
 - defaults
 when:
 - ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
 - ("--fstab" | length == 0)
 - (device\_name.stdout | length == 0)
 tags:
 - configure\_strategy
 - high\_disruption
 - low\_complexity
 - medium\_severity
 - mount\_option\_var\_tmp\_nodev
 - no\_reboot\_needed

- name: 'Add nodev Option to /var/tmp: Make sure nodev option is part of the to /var/tmp
 options'
 set\_fact:
 mount\_info: '{{ mount\_info | combine( {''options'':''''~mount\_info.options~'',nodev''
 }) }}'
 when:
 - ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
 - mount\_info is defined and "nodev" not in mount\_info.options
 tags:
 - configure\_strategy
 - high\_disruption
 - low\_complexity
 - medium\_severity
 - mount\_option\_var\_tmp\_nodev
 - no\_reboot\_needed

- name: 'Add nodev Option to /var/tmp: Ensure /var/tmp is mounted with nodev option'
 mount:
 path: /var/tmp
 src: '{{ mount\_info.source }}'
 opts: '{{ mount\_info.options }}'
 state: mounted
 fstype: '{{ mount\_info.fstype }}'
 when:
 - ( ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 and "/var/tmp" in ansible\_mounts | map(attribute="mount") | list )
 - (device\_name.stdout is defined and (device\_name.stdout | length > 0)) or ("--fstab"
 | length == 0)
 tags:
 - configure\_strategy
 - high\_disruption
 - low\_complexity
 - medium\_severity
 - mount\_option\_var\_tmp\_nodev
 - no\_reboot\_needed