About

Imported from CyberStrikeus/CyberStrike (.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-1-1-9/SKILL.md). Install upstream with npx skills add CyberStrikeus/CyberStrike --skill cis-ubuntu1404-v210-1-1-9. Copyright stays with the author.

1.1.9 Ensure noexec option set on /var/tmp partition (Scored)

Name: CIS Ubuntu 14.04 LTS - 1.1.9 Ensure noexec option set on /var/tmp partition
Author: CyberStrikeus

Profile Applicability

Level 1 - Server
Level 1 - Workstation

Description

The noexec mount option specifies that the filesystem cannot contain executable binaries.

Rationale

Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp.

Audit Procedure

mount | grep /var/tmp
# Verify that the noexec option is set on /var/tmp
# Expected output: tmpfs on /var/tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Expected Result

The output should show the noexec option is set for the /var/tmp partition.

Remediation

# Edit the /etc/fstab file and add noexec to the fourth field (mounting options)
# for the /var/tmp partition. See the fstab(5) manual page for more information.

# Run the following command to remount /var/tmp:
mount -o remount,noexec /var/tmp

Default Value

By default, the noexec option is not set on /var/tmp.

References

CIS Ubuntu Linux 14.04 LTS Benchmark v2.1.0
CIS Controls: 2 Inventory of Authorized and Unauthorized Software

Profile

Level 1

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu1404-v210-1-1-9/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberstrikeus-cyberstrike-cis-ubuntu1404-v210-1-1-9.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberstrikeus-cyberstrike-cis-ubuntu1404-v210-1-1-9",
  "kind": "skill",
  "name": "CIS Ubuntu 14.04 LTS - 1.1.9 Ensure noexec option set on /var/tmp partition",
  "description": "Ensure noexec option is set on /var/tmp partition to prevent executable binaries",
  "publisher": "CyberStrikeus",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cis",
      "ubuntu",
      "ubuntu-14-04",
      "level-1",
      "scored",
      "filesystem",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Ensure noexec option is set on /var/tmp partition to prevent executable binaries"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/CyberStrikeus/CyberStrike",
      "path": ".cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-1-1-9/SKILL.md",
      "ref": "df28ccd3dc6d6c02391169121ee2dcdf4a6a132b",
      "url": "https://github.com/CyberStrikeus/CyberStrike/blob/df28ccd3dc6d6c02391169121ee2dcdf4a6a132b/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-1-1-9/SKILL.md",
      "key": "CyberStrikeus/CyberStrike/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-1-1-9/SKILL.md"
    }
  },
  "instructions": "# 1.1.9 Ensure noexec option set on /var/tmp partition (Scored)\n\n## Profile Applicability\n\n- Level 1 - Server\n- Level 1 - Workstation\n\n## Description\n\nThe noexec mount option specifies that the filesystem cannot contain executable binaries.\n\n## Rationale\n\nSince the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp.\n\n## Audit Procedure\n\n```bash\nmount | grep /var/tmp\n# Verify that the noexec option is set on /var/tmp\n# Expected output: tmpfs on /var/tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)\n``",
  "cost": {
    "context_tokens": 300
  }
}

Fetch it by URL: GET /api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu1404-v210-1-1-9/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.