Skip to content

0063-shm-nodev-Ensure the nodev option is set on the /dev/shm partition

Rule ID

  • 0063-shm-nodev

Category

  • system

Level

  • warn

Compatible Versions

  • Linux

Description

  • The nodev mount option specifies that the filesystem cannot contain special devices.

  • Note: /dev/shm is automatically mounted by systemd. However, even if /dev/shm is already mounted at boot time, the mount option must still be added in /etc/fstab.

Scan Frequency

  • 0 */30 * * *

Rationale

  • Because the /dev/shm filesystem is not intended to support devices, this option is set to ensure that users cannot attempt to create special devices in the /dev/shm partition.

Risk Items

  • Hacker intrusion

  • Data leakage

  • Cryptomining risk

  • Botnet risk

Audit Method

  • Run the following command to check whether the nodev option is set:
# mount | grep -E "\s/dev/shm\s" | grep -v nodev
Nothing should be returned

Remediation

  • Edit the /etc/fstab file and add nodev to the fourth field of the /dev/shm partition mount options. For more information, refer to the fstab(5) man page. Run the following command to remount /dev/shm.
# mount -o remount,noexec,nodev,nosuid /dev/shm

Impact

  • None

Default Value

References

CIS Controls

  • Version 7 5.1 Establish Secure Configurations Maintain documented, standard security configuration standards for all authorized operating systems and software. 13 Data Protection Data Protection

Feedback

Is this page helpful?