documentation_complete: true


title: 'Add nodev Option to /var/tmp'

description: |-
    The <tt>nodev</tt> mount option can be used to prevent device files from
    being created in <tt>/var/tmp</tt>. Legitimate character and block devices
    should not exist within temporary directories like <tt>/var/tmp</tt>.
    {{{ describe_mount(option="nodev", part="/var/tmp") }}}

rationale: |-
    The only legitimate location for device files is the <tt>/dev</tt> directory
    located on the root partition. The only exception to this is chroot jails.

{{{ complete_ocil_entry_mount_option("/var/tmp", "nodev") }}}

severity: medium

identifiers:
    cce@rhcos4: CCE-82735-2
    cce@rhel8: CCE-82068-8
    cce@rhel9: CCE-83864-9
    cce@rhel10: CCE-89441-0
    cce@sle12: CCE-92305-2
    cce@sle15: CCE-92459-7

references:
    cis@sle12: 1.1.13
    cis@sle15: 1.1.13
    srg: SRG-OS-000368-GPOS-00154
    stigid@ol8: OL08-00-040132

platform: mount[var-tmp]

template:
    name: mount_option
    vars:
        mountpoint: /var/tmp
        mountoption: nodev

fixtext: |-
    {{{ fixtext_mount_option("/var/tmp", "nodev") }}}

srg_requirement: '{{{ srg_requirement_mount_option("/var/tmp", "nodev") }}}'
