documentation_complete: true

title: 'Ensure /var Located On Separate Partition'

description: |-
    The <tt>/var</tt> directory is used by daemons and other system
    services to store frequently-changing data. Ensure that <tt>/var</tt> has its own partition
    or logical volume at installation time, or migrate it using LVM.

rationale: |-
    Ensuring that <tt>/var</tt> is mounted on its own partition enables the
    setting of more restrictive mount options. This helps protect
    system services such as daemons or other programs which use it.
    It is not uncommon for the <tt>/var</tt> directory to contain
    world-writable directories installed by other software packages.

severity: low

identifiers:
    cce@rhel8: CCE-80852-7
    cce@rhel9: CCE-83466-3
    cce@rhel10: CCE-89166-3
    cce@sle12: CCE-83153-7
    cce@sle15: CCE-85640-1
    cce@slmicro5: CCE-93797-9
    cce@slmicro6: CCE-95067-5 

references:
    cis-csc: 12,15,8
    cis@sle12: 1.1.10
    cis@sle15: 1.1.10
    cobit5: APO13.01,DSS05.02
    isa-62443-2013: 'SR 3.1,SR 3.5,SR 3.8,SR 4.1,SR 4.3,SR 5.1,SR 5.2,SR 5.3,SR 7.1,SR 7.6'
    iso27001-2013: A.13.1.1,A.13.2.1,A.14.1.3
    nist: CM-6(a),SC-5(2)
    nist-csf: PR.PT-4
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-021320
    stigid@ol8: OL08-00-010540
    stigid@sle12: SLES-12-010860
    stigid@sle15: SLES-15-040210

{{{ complete_ocil_entry_separate_partition(part="/var") }}}

fixtext: '{{{ fixtext_separate_partition(part="/var") }}}'

srg_requirement: '{{{ srg_requirement_separate_partition("/var") }}}'


template:
    name: mount
    vars:
        mountpoint: /var
        min_size: 3221225472
