Ensure /tmp Located On Separate Partition
Verifies that /tmp is mounted on its own partition or tmpfs so restrictive options (nodev, nosuid, noexec) can protect temporary storage.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/tmp is world-writable temporary storage used by many programs and any user. Mounting it separately (a dedicated partition or a tmpfs unit) lets you enforce nodev, nosuid and noexec, blocking execution of dropped payloads and setuid abuse, and prevents a flood of temp files from filling the root filesystem.
What Pavois checks
Pavois uses the InSpec mount('/tmp') resource, reading the effective mount table (/proc/self/mountinfo) rather than /etc/fstab. This catches a /tmp provided by the systemd tmp.mount unit or a runtime tmpfs, mounts a plain fstab parse would miss, and confirms what the kernel actually mounted.
describe mount('/tmp') do
it { should be_mounted }
endHow to verify it is applied
Run:
findmnt /tmp
Expected: a row showing /tmp as its own mount (a separate device or a tmpfs), ideally with nodev,nosuid,noexec. No output means /tmp lives on the root filesystem and the rule fails.
Inspect & investigate
Check the live mount with findmnt /tmp or mount | grep ' /tmp '. If a systemd unit provides it, inspect systemctl status tmp.mount and journalctl -u tmp.mount; persistent fstab config is in /etc/fstab. Enable the unit with systemctl enable --now tmp.mount where applicable.
Remediation
No automated harden plan ships for this rule, so apply it manually. The easiest route is the systemd tmp.mount unit (systemctl enable --now tmp.mount), which provides a hardened tmpfs /tmp without repartitioning; alternatively add a dedicated partition or a tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec 0 0 line to /etc/fstab and remount.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # /tmp must be its own filesystem. Simplest without repartitioning: make it a tmpfs via systemd: systemctl unmask tmp.mount && systemctl enable --now tmp.mount # (review /usr/share/systemd/tmp.mount first). A real disk partition requires offline disk work. |
|---|---|
| reason | a separate /tmp filesystem needs partitioning/tmpfs, not a safe runtime change |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A tmpfs /tmp is volatile (cleared on reboot) and sized from RAM, so workloads writing large temp files may hit ENOSPC; noexec can break installers or build tools that execute from /tmp. Precautions: size the tmpfs appropriately, identify any service that runs code from /tmp before enabling noexec, and verify temp-heavy applications after the change. Switching /tmp to a unit/mount is reversible but clears existing contents.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.2.1.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), SC-5(2) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.