documentation_complete: true

title: 'Ensure tmp.mount Unit Is Enabled'

description: |-
    The <tt>/tmp</tt> directory is a world-writable directory used
    for temporary file storage. This directory is managed by <tt>systemd-tmpfiles</tt>.
    Ensure that the <tt>tmp.mount</tt> systemd unit is enabled.

rationale: |-
    The <tt>/tmp</tt> directory is used as temporary storage by many programs.
    Placing <tt>/tmp</tt> in a tmpfs filesystem enables the setting of more
    restrictive mount options, which can help protect programs which use it.
    The <tt>tmp.mount</tt> unit configures the tmpfs filesystem and ensures
    the <tt>/tmp</tt> directory is wiped during reboot.

severity: low

identifiers:
    cce@rhel8: CCE-86890-1
    cce@rhel9: CCE-86891-9
    cce@rhel10: CCE-89797-5

ocil: |-
    {{{ ocil_systemd_mount_enabled("tmp") }}}

ocil_clause: "the tmp.mount unit is masked or disabled"


template:
    name: systemd_mount_enabled
    vars:
        mountname: tmp
