Shared Memory and Mount Options

/dev/shm is a RAM-backed directory every user can write to. If programs can run from it, it's the perfect place to drop a payload that never touches the disk. Mount options in /etc/fstab fix that, and the same options harden /tmp and any user-writable partition.

The options

Option	Meaning
noexec	Nothing in this filesystem can be executed
nosuid	Setuid bits are ignored, so a setuid binary copied here doesn't grant root
nodev	Device files here are ignored

The benchmark (CIS 1.1.2.x) wants nodev, nosuid, and noexec on /dev/shm, /tmp, and /var/tmp; nodev and nosuid on /home, /var, /var/log, and /var/log/audit; and noexec on the two log directories as well. The separate-partition items (1.1.2.3.1 and the like, Level 2) can't be done on a running image without repartitioning; note them and move on. The mount options can be set on any directory that is its own mount, and that's what this page does.

Apply to /dev/shm

Add to /etc/fstab (one line, if there isn't already a tmpfs /dev/shm line; if there is, edit its options):

grep -q '/dev/shm' /etc/fstab || echo 'tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0' | sudo tee -a /etc/fstab
sudo mount -o remount /dev/shm

The line must start with tmpfs and contain both noexec and nosuid; that's what a reader of the file will look for.

/tmp and /var/tmp

If /tmp is its own filesystem (findmnt /tmp shows a source), add noexec,nosuid,nodev to its fstab line the same way. If it's just a directory on /, it can be made a tmpfs:

echo 'tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev 0 0' | sudo tee -a /etc/fstab

That takes effect at the next reboot. Some package installs run scripts from /tmp; if apt breaks afterward, sudo mount -o remount,exec /tmp for the install and remount without it after.

The other mounts

findmnt -o TARGET,SOURCE,OPTIONS /home /var /var/tmp /var/log /var/log/audit 2>/dev/null

For each one that has its own line (its own partition or a bind mount), add the options to its fstab entry: nodev,nosuid for /home and /var, nodev,nosuid,noexec for /var/tmp, /var/log, and /var/log/audit. Then sudo mount -o remount /var/tmp and so on. A directory that isn't its own mount inherits /, and there's nothing to set.

Removable media

/etc/fstab entries for USB or CD mounts should carry noexec,nosuid,nodev too. Desktop automount is on the Screen Lock and Login Screen page.

Verify

grep -E '^tmpfs' /etc/fstab
findmnt -o TARGET,OPTIONS /dev/shm /tmp

findmnt shows the live options; noexec,nosuid must appear for /dev/shm.

Example

findmnt /dev/shm shows rw,nosuid,nodev and no noexec, and ls -la /dev/shm shows an executable .cache file owned by www-data. That's a payload running from memory. Kill the process using it (sudo fuser -k /dev/shm/.cache), delete the file, add the fstab line with noexec, remount.

Try it

1. Copy /bin/ls to /dev/shm and run it. Remount with noexec and run it again.
2. Read findmnt for every mount and note which options each has.

Build it

A mounts.sh that prints findmnt -o TARGET,OPTIONS for the paths on this page and flags any missing noexec, nosuid, or nodev.

Next

The Bootloader