documentation_complete: true


title: 'Add nosuid Option to /var/tmp'

description: |-
    The <tt>nosuid</tt> mount option can be used to prevent
    execution of setuid programs in <tt>/var/tmp</tt>. The SUID and SGID permissions
    should not be required in these world-writable directories.
    {{{ describe_mount(option="nosuid", part="/var/tmp") }}}

rationale: |-
    The presence of SUID and SGID executables should be tightly controlled. Users
    should not be able to execute SUID or SGID binaries from temporary storage partitions.

{{{ complete_ocil_entry_mount_option("/var/tmp", "nosuid") }}}

severity: medium

identifiers:
    cce@rhcos4: CCE-82736-0
    cce@rhel8: CCE-82154-6
    cce@rhel9: CCE-83863-1
    cce@rhel10: CCE-87892-6
    cce@sle12: CCE-91593-4
    cce@sle15: CCE-91279-0

references:
    cis@sle12: 1.1.14
    cis@sle15: 1.1.14
    srg: SRG-OS-000368-GPOS-00154
    stigid@ol8: OL08-00-040133

platform: mount[var-tmp]

template:
    name: mount_option
    vars:
        mountpoint: /var/tmp
        mountoption: nosuid

fixtext: |-
    {{{ fixtext_mount_option("/var/tmp", "nosuid") }}}

srg_requirement: '{{{ srg_requirement_mount_option("/var/tmp", "nosuid") }}}'
