Ensure /var/tmp Located On Separate Partition
Mounts /var/tmp on a dedicated filesystem so restrictive options (noexec, nosuid, nodev) can protect this world-writable temp area.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/tmp is world-writable temporary storage used by many programs and a classic place for an attacker to drop and run a payload. A dedicated partition lets you apply hardening mount options, nodev, nosuid and especially noexec, that block device nodes, setuid escalation and execution of files staged there, while also stopping temp-file growth from filling the root filesystem.
What Pavois checks
Pavois checks the effective mount table via the mount('/var/tmp') resource (findmnt / /proc/self/mountinfo), not /etc/fstab. fstab describes intent only, a mount can fail at boot or be overridden (e.g. by a systemd .mount unit or a tmpfs). Reading the live kernel state confirms /var/tmp is really a separate mounted filesystem now.
describe mount('/var/tmp') do
it { should be_mounted }
endHow to verify it is applied
Run findmnt /var/tmp. A returned line confirms a dedicated filesystem; empty output means it shares /var or /, and the rule fails. Review the options column for noexec,nosuid,nodev.
Inspect & investigate
Confirm with findmnt /var/tmp and df -h /var/tmp. Boot-time mount issues appear in journalctl -b | grep -i var-tmp and systemctl status var-tmp.mount.
Remediation
There is no automated harden plan: this requires repartitioning, which is not safe on a live system. Apply it manually, ideally at install time, by allocating a dedicated partition or LVM volume for /var/tmp (or a tmpfs) and declaring it in /etc/fstab with noexec,nosuid,nodev.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # /var/tmp should be its OWN filesystem (isolation + mount options). This needs (re)partitioning , # offline disk/LVM work, not a safe runtime change. findmnt /var/tmp >/dev/null 2>&1 && echo '/var/tmp is already a mount point' || echo '/var/tmp is NOT separate' # Then: dedicate an LVM volume / disk to /var/tmp and add it to /etc/fstab. # /var/tmp can instead be a tmpfs, add: tmpfs /var/tmp tmpfs defaults,rw,nosuid,nodev,noexec 0 0 |
|---|---|
| reason | a separate /var/tmp filesystem needs partitioning/LVM/tmpfs, not a safe runtime change |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving /var/tmp on root forfeits noexec/nosuid protection and lets temp-file growth threaten the root filesystem. Precautions before applying: some installers and packages execute scripts from /var/tmp, so noexec can break certain upgrades or third-party setup tooling, test first. Migrate with the system quiesced, copy with rsync -aHAX preserving the sticky bit (chmod 1777 /var/tmp), and keep console/rescue access in case the new mount fails at boot.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R28 | direct | 2.0 | high |
| CIS | 1.1.2.5.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.