Add noexec Option to /var/log
Mounts /var/log with the noexec option so the kernel refuses to execute any binary located there.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log is meant to store log files, never executable code. The noexec option makes the kernel refuse to run any program located on this partition. Allowing execution there serves no operational purpose and would give an attacker who can write to the partition a place to stage and run malware while hiding among log files; noexec removes that opportunity.
What Pavois checks
Pavois inspects the effective mount with mount('/var/log') and asserts its resolved options include noexec. It reads the live kernel mount table, the options actually enforced, rather than /etc/fstab, so it catches a partition remounted without the flag, a systemd mount-unit override, or an fstab entry that never applied, which a file-based scanner would wrongly pass.
describe mount('/var/log') do
its('options') { should include 'noexec' }
end
describe command("{ findmnt --fstab -no OPTIONS /var/log 2>/dev/null; grep -hsE '[[:space:]]/var/log[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /var/log 2>/dev/null) 2>/dev/null; } | grep -ow 'noexec'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt /var/log (or findmnt -no OPTIONS /var/log) and confirm noexec is in the option list. Expected output contains noexec, e.g. /var/log ... rw,nosuid,nodev,noexec,relatime.
Inspect & investigate
Mount state is queried live with findmnt /var/log or cat /proc/mounts, not from a log. Boot-time and remount events appear via journalctl -b | grep -i /var/log. Blocked execution attempts surface as Permission denied in the calling program's logs.
Remediation
No automated harden plan ships for this rule yet, so it must be applied manually: this requires /var/log to be a separate partition. Add noexec to its /etc/fstab entry, then mount -o remount /var/log, or reboot, and re-scan to confirm.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/var/log -v o=noexec '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /var/log && mount -o remount,noexec /var/log || true |
|---|---|
| name | mount-var-log-noexec |
| not_if | awk -v m=/var/log '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx noexec |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Functional impact is usually nil, but verify first: a few log-rotation or monitoring agents drop and run helper scripts under /var/log, check logrotate postrotate hooks and any vendor agents before applying. Precautions: the option can only be set if /var/log is a dedicated partition; on a default layout you must first carve it out (a disruptive change requiring planning, migration of existing logs, and a reboot). Quiesce logging services before migrating data so log files are not corrupted mid-write.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
| CIS | 1.1.2.6.4 | direct | per OS, see the benchmark table | high |
| NIST | AC-6, AC-6(1), CM-6(a), CM-7(a), CM-7(b), MP-7 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.