Add noexec Option to /dev/shm
Mounts the /dev/shm shared-memory tmpfs with the noexec option so no binary can be executed from it.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/dev/shm is a world-writable shared-memory tmpfs. Allowing execution from such a directory is a classic foothold: malware and exploit payloads frequently drop a binary into a writable, executable location and run it from there. Mounting /dev/shm with noexec blocks execution of any program stored in it, closing that staging path.
What Pavois checks
Pavois reads the effective mount via mount('/dev/shm') and asserts the resolved options include noexec. /dev/shm is mounted by systemd (dev-shm.mount) and frequently absent from /etc/fstab, so only the live mount table reveals its real options, a file-based check could pass falsely or overlook the mount.
describe mount('/dev/shm') do
its('options') { should include 'noexec' }
end
describe command("{ findmnt --fstab -no OPTIONS /dev/shm 2>/dev/null; grep -hsE '[[:space:]]/dev/shm[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /dev/shm 2>/dev/null) 2>/dev/null; } | grep -ow 'noexec'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /dev/shm (or findmnt -no OPTIONS /dev/shm) and confirm noexec is present, e.g. rw,nosuid,nodev,noexec,relatime.
Inspect & investigate
Use findmnt /dev/shm to see active options and systemctl show dev-shm.mount -p Options for the systemd value. Execution of a file from a noexec mount fails with Permission denied; auditd EXECVE denials in /var/log/audit/audit.log can highlight blocked attempts, a useful malware indicator.
Remediation
This rule has no automated harden plan: apply it manually. Add an explicit /dev/shm entry to /etc/fstab such as tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0, then mount -o remount /dev/shm (or systemctl restart dev-shm.mount) and verify with findmnt /dev/shm.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| device | tmpfs |
|---|---|
| fstype | tmpfs |
| mount_point | /dev/shm |
| option | noexec |
| resource | mount |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without noexec, /dev/shm is an easy launch pad for fileless-style attacks and dropped payloads. Precaution: a few applications execute code from shared memory, notably some sandboxed browsers (Chromium/Electron) and a handful of installers or JIT runtimes. Test such workloads after applying; if one breaks, it usually has a config flag to use a different temp/exec directory. The remount itself is non-disruptive.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.2.2.4 | direct | per OS, see the benchmark table | high |
| NIST | AC-6, AC-6(1), CM-6(a), CM-7(a), CM-7(b), MP-7 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.