Add nosuid Option to /var/tmp
Mount /var/tmp with the nosuid option so SUID/SGID bits on files there are ignored by the kernel.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
SUID and SGID executables run with elevated privileges and must be tightly controlled, users should never be able to run SUID/SGID binaries from temporary storage. Mounting /var/tmp with nosuid makes the kernel ignore those bits, so a SUID-root binary dropped into this world-writable directory cannot be used to escalate privileges.
What Pavois checks
Pavois reads the effective mount options via mount('/var/tmp'), the live kernel view. Because /var/tmp is frequently a bind mount or systemd tmpfs, this catches runtime/bind configurations that parsing /etc/fstab alone would miss.
describe mount('/var/tmp') do
its('options') { should include 'nosuid' }
end
describe command("{ findmnt --fstab -no OPTIONS /var/tmp 2>/dev/null; grep -hsE '[[:space:]]/var/tmp[[:space:]]' /etc/fstab 2>/dev/null; systemctl show -p Options -- $(systemd-escape -p --suffix=mount /var/tmp 2>/dev/null) 2>/dev/null; } | grep -ow 'nosuid'") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run findmnt -no OPTIONS /var/tmp and confirm nosuid is present. Example output: rw,nosuid,nodev,noexec,relatime.
Inspect & investigate
Inspect mount state with findmnt /var/tmp and mount | grep ' /var/tmp '. Kernel mount events appear in journalctl -k / dmesg. To find SUID files that would be neutralized, run find /var/tmp -perm -4000 -o -perm -2000.
Remediation
There is no automated harden plan for this rule, because /var/tmp must be a separate filesystem or bind mount to carry its own options. Apply it manually: configure /var/tmp as its own mount, add nosuid to its /etc/fstab entry (or systemd mount unit), then mount -o remount /var/tmp and reboot to confirm persistence.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -v m=/var/tmp -v o=nosuid '$0!~/^[[:space:]]*#/&&$2==m{n=split($4,a,",");h=0;for(i=1;i<=n;i++)if(a[i]==o)h=1;if(!h)$4=$4","o}{print}' /etc/fstab >/etc/.fstab.pav && cat /etc/.fstab.pav >/etc/fstab && rm -f /etc/.fstab.pav; mountpoint -q /var/tmp && mount -o remount,nosuid /var/tmp || true |
|---|---|
| name | mount-var-tmp-nosuid |
| not_if | awk -v m=/var/tmp '$2==m&&$0!~/^[[:space:]]*#/{print $4}' /etc/fstab | tr , '\n' | grep -qx nosuid |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
What can break: almost nothing, no legitimate workflow stores SUID/SGID binaries in a temporary directory. Precautions: before enforcing, sanity-check with find /var/tmp -perm -4000 -o -perm -2000 (should normally be empty). If /var/tmp is not yet a separate mount, making it one (often a bind mount) is the prerequisite. Reboot to confirm the option persists.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
| CIS | 1.1.2.5.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.