Add noexec Option to /var/tmp
Mount /var/tmp with the noexec option so binaries cannot be executed from this temporary directory.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/tmp is a world-writable temporary directory; executing binaries from it is never needed in normal operation. Mounting it noexec stops attackers and malware from running a dropped payload from this classic staging area, cutting off a very common privilege-escalation and persistence path.
What Pavois checks
Pavois reads the effective mount options via mount('/var/tmp'), the live kernel view. Since /var/tmp is frequently a bind mount or systemd tmpfs, this catches runtime/bind configurations that parsing /etc/fstab alone would miss.
describe mount('/var/tmp') do
its('options') { should include 'noexec' }
end
describe command("{ findmnt --fstab -no OPTIONS /var/tmp 2>/dev/null; grep -hsE '[[:space:]]/var/tmp[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /var/tmp 2>/dev/null) 2>/dev/null; } | grep -ow 'noexec'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt -no OPTIONS /var/tmp and confirm noexec is present. You can also test directly: copy /bin/true into /var/tmp and run it, it should fail with Permission denied.
Inspect & investigate
Inspect mount state with findmnt /var/tmp and mount | grep ' /var/tmp '. A blocked execution attempt surfaces as Permission denied; kernel mount events appear in journalctl -k / dmesg.
Remediation
There is no automated harden plan for this rule, because /var/tmp must be a separate filesystem or bind mount to carry its own options. Apply it manually: configure /var/tmp as its own mount, add noexec to its /etc/fstab entry (or systemd mount unit), then mount -o remount /var/tmp and reboot to confirm persistence.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/var/tmp -v o=noexec '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /var/tmp && mount -o remount,noexec /var/tmp || true |
|---|---|
| name | mount-var-tmp-noexec |
| not_if | awk -v m=/var/tmp '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx noexec |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
What can break: package managers and installers that extract and run helper scripts/binaries from /var/tmp (some dpkg/rpm post-install steps, certain agents and backup tools use it as a scratch area) may fail. Precautions: before enforcing, point such tools at an exec-capable scratch dir via TMPDIR, and test installs/upgrades in staging. If /var/tmp is not yet a separate mount, making it one (often a bind mount) is the prerequisite. Reboot to confirm the option persists.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
| CIS | 1.1.2.5.4 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.