Add nodev Option to /tmp
Mounts /tmp with the nodev option so the kernel refuses to interpret device files placed in that directory.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The only legitimate place for device files is /dev on the root partition (chroot jails being the rare exception). Mounting /tmp with nodev tells the kernel to ignore any character or block special device found there. Without it, an attacker who can write to the world-writable /tmp could plant a device node (for example a copy of /dev/sda or /dev/mem) and use it to bypass filesystem permissions and read or tamper with raw disk or kernel memory.
What Pavois checks
Pavois inspects the effective mount with mount('/tmp') and asserts that its resolved options include nodev. This reads the live mount table (what the kernel actually applied), not /etc/fstab, so it catches a partition remounted at runtime, an option dropped by a systemd mount unit, or an entry that never took effect, which a file-based scanner reading /etc/fstab alone would miss.
describe mount('/tmp') do
its('options') { should include 'nodev' }
end
describe command("{ findmnt --fstab -no OPTIONS /tmp 2>/dev/null; grep -hsE '[[:space:]]/tmp[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /tmp 2>/dev/null) 2>/dev/null; } | grep -ow 'nodev'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /tmp (or findmnt -no OPTIONS /tmp) and confirm nodev is present in the option list. You can also use mount | grep ' /tmp '. Expected output contains nodev, e.g. /tmp ... rw,nosuid,nodev,noexec,relatime.
Inspect & investigate
Mount state is not in a log file; query it live with findmnt /tmp or cat /proc/mounts. Remount and boot-time mount events are visible via journalctl -b | grep -i tmp or journalctl -u tmp.mount when /tmp is backed by a systemd mount unit.
Remediation
No automated harden plan ships for this rule yet, so it must be applied manually: add nodev to the /tmp entry's options in /etc/fstab (or to the relevant systemd mount unit), then mount -o remount /tmp, or reboot, and re-scan to confirm.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| device | tmpfs |
|---|---|
| fstype | tmpfs |
| mount_point | /tmp |
| option | nodev |
| resource | mount |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Functional impact is low: legitimate software almost never needs device nodes under /tmp. Precautions: ensure /tmp is a real separate mount (or a tmpfs) before adding the option, on systems where /tmp lives on the root filesystem there is no dedicated mount to set it on, and you must first carve out a partition or a tmpfs unit. Apply with mount -o remount /tmp; if a remount fails because of busy files, schedule it for the next reboot rather than forcing it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.2.1.2 | direct | per OS, see the benchmark table | high |
| NIST | AC-6, AC-6(1), CM-6(a), CM-7(a), CM-7(b), MP-7 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.