0062-shm-noexec - /dev/shm partition does not have the noexec option set¶

Rule ID¶

• 0062-shm-noexec

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• The noexec mount option specifies that the file system cannot contain executable binaries.

• Note: /dev/shm is automatically mounted by systemd. However, even if /dev/shm is already mounted at boot time, the mount option must still be added in /etc/fstab.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Setting this option on the file system prevents users from executing programs from shared memory.

  This can block users from introducing potentially malicious software onto the system.

Risk Items¶

• Hacker infiltration

• Data leakage

• Cryptomining risk

• Risk of being used as a bot

Audit Method¶

• Run the following command to check whether the noexec option is set:

# mount | grep -E "\s/dev/shm\s" | grep -v noexec
Nothing should be returned

Remediation¶

• Edit the /etc/fstab file and add noexec to the fourth field (mount options) for the /dev/shm partition. For more information, refer to the fstab(5) man page. Execute the following command to remount /dev/shm:

  # mount -o remount,noexec,nodev,nosuid /dev/shm
  

Impact¶

• None

Default Value¶

• None

References¶

CIS Controls¶

• Version 7

2.6 Address unapproved software

Ensure that unauthorized software is removed or the inventory is updated in a timely manner.

13 Data Protection

Data Protection