0064-shm-nosuid - /dev/shm partition does not have the nosuid option set¶

Rule ID¶

• 0064-shm-nosuid

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• The nosuid mount option specifies that the file system cannot contain setuid files.

• Note: /dev/shm is automatically mounted by systemd. However, even if /dev/shm is already mounted at boot time, the mount option must still be added in /etc/fstab.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Setting this option on a file system prevents users from introducing privileged programs into the system and allowing non-root users to execute them.

Risk Items¶

• Hacker Penetration
• Data Leakage
• Crypto Mining Risk
• Botnet Risk

Audit Method¶

• Run the following command to check whether the nosuid option is set:

# mount | grep -E "\s/dev/shm\s" | grep -v nosuid
Nothing should be returned

Remediation¶

• Edit the /etc/fstab file and add nosuid to the fourth field of the mount options for the /dev/shm partition. For more information, refer to the fstab(5) manual page. Run the following command to remount /dev/shm:

# mount -o remount,noexec,nodev,nosuid /dev/shm

Impact¶

• None

Default Value¶

References¶

CIS Controls¶

• Version 7

5.1 Establish Secure Configurations

Maintain documented, standard security configuration standards for all authorized operating systems and software.

13 Data Protection

Data Protection