TMA-COS-1.1.2

Ensure /tmp is configured

MittelStufe 1Automatisiertcos

Beschreibung

The /tmp directory is a world-writable directory used for temporary storage by all users and some applications. Making /tmp its own file system allows an administrator to set the noexec option on the mount, making /tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw. This can be accomplished by either mounting tmpfs to /tmp, or creating a separate partition for /tmp.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v mount >/dev/null 2>&1 || { echo "step1: mount not installed"; return 1; }; o=$(bash -c 'mount | grep -E '"'"'\s/tmp\s'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)' || { echo step1: missing 'tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)'; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled tmp.mount' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- static || { echo step2: missing static; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Run the following commands to configure mount options systemctl edit tmp.mount Edit the file to define the options that needs to be set. For example: [Mount] Options= Options=mode=1777,strictatime,noexec,nodev,nosuid Restart the tmp.mount systemctl daemon-reload # might be optional systemctl restart tmp.mount /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.

Eigenschaften

Betriebssysteme: Beliebig
Tags: container-optimized-oscos
Referenz: CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.1.2 Ensure /tmp is configured

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target cos