TMA-COS-1.1.2

Ensure /tmp is configured

MediumLevel 1Automatedcos

Description

The /tmp directory is a world-writable directory used for temporary storage by all users and some applications. Making /tmp its own file system allows an administrator to set the noexec option on the mount, making /tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw. This can be accomplished by either mounting tmpfs to /tmp, or creating a separate partition for /tmp.

How it is checked

Audit method: Shell command

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v mount >/dev/null 2>&1 || { echo "step1: mount not installed"; return 1; }; o=$(bash -c 'mount | grep -E '"'"'\s/tmp\s'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)' || { echo step1: missing 'tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)'; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled tmp.mount' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- static || { echo step2: missing static; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands to configure mount options systemctl edit tmp.mount Edit the file to define the options that needs to be set. For example: [Mount] Options= Options=mode=1777,strictatime,noexec,nodev,nosuid Restart the tmp.mount systemctl daemon-reload # might be optional systemctl restart tmp.mount /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.

Properties

Operating systems: Any
Tags: container-optimized-oscos
Reference: CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.1.2 Ensure /tmp is configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cos