documentation_complete: true


title: 'Add noexec Option to /var'

description: |-
    The <tt>noexec</tt> mount option can be used to prevent binaries from being
    executed out of <tt>/var</tt>.
    {{{ describe_mount(option="noexec", part="/var") }}}

rationale: |-
    The <tt>/var</tt> directory contains variable system data such as logs,
    mails and caches. No binaries should be executed from this directory.

{{{ complete_ocil_entry_mount_option("/var", "noexec") }}}

severity: medium

identifiers:
    cce@rhel8: CCE-83330-1
    cce@rhel9: CCE-83865-6
    cce@rhel10: CCE-90153-8
    cce@sle12: CCE-91590-0
    cce@sle15: CCE-91276-6

platform: mount[var]

template:
    name: mount_option
    vars:
        mountpoint: /var
        mountoption: noexec
