CCE-95432-1Platform: cpe:/o:amazon:linux:2, cpe:/o:centos:centos:7, cpe:/o:oracle:linux:7, cpe:/o:oracle:linux:8, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:9 | Date: (C)2021-03-05 (M)2023-07-04 |
Description:
The nodev mount option specifies that the filesystem cannot contain special devices.
Rationale:
Since the user partitions are not intended to support devices, set this option to ensure that
users cannot attempt to create block or character special devices.
Audit:
Verify that the nodev option is set if a /home partition exists.
Run the following command and verify that nothing is returned:
# mount | grep -E 's/homes' | grep -v nodev
Remediation:
Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the /home
partition. See the fstab(5) manual page for more information.
# mount -o remount, nodev /home
Notes:
The actions in this recommendation refer to the /homepartition, which is the default user
partition that is defined in many distributions. If you have created other user partitions, it
is recommended that the Remediation and Audit steps be applied to these partitions as
well.
Parameter:
[yes/no]
Technical Mechanism:
Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the /home
partition. See the fstab(5) manual page for more information.
# mount -o remount, nodev /home
CCSS Severity: | CCSS Metrics: |
CCSS Score : 7.8 | Attack Vector: LOCAL |
Exploit Score: 1.1 | Attack Complexity: HIGH |
Impact Score: 6.0 | Privileges Required: LOW |
Severity: HIGH | User Interaction: NONE |
Vector: AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H | Scope: CHANGED |
| Confidentiality: HIGH |
| Integrity: HIGH |
| Availability: HIGH |
| |
References: Resource Id | Reference |
---|
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:68583 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:71965 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:84205 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:72983 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:72878 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:72331 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:72669 |
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:72772 |