TMA-COS-1.1.9
Ensure nodev option set on /home partition
MediumLevel 1Automatedcos
Description
The nodev mount option specifies that the filesystem cannot contain special devices. Since the user partitions are not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices.
How it is checked
Audit method: Shell command
shell
if ! findmnt -kn /home >/dev/null 2>&1; then echo compliant; elif findmnt -kn /home | grep -qw -- nodev; then echo compliant; else echo /home' is mounted without nodev'; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to remount /var : # mount -o remount,nodev /home /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.
Properties
- Operating systems
- Any
- Tags
- container-optimized-oscos
- Reference
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.1.9 Ensure nodev option set on /home partition
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cos