TMA-COS-1.1.2

Ensure /tmp is configured

MoyenneNiveau 1Automatiséecos

Description

The /tmp directory is a world-writable directory used for temporary storage by all users and some applications. Making /tmp its own file system allows an administrator to set the noexec option on the mount, making /tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw. This can be accomplished by either mounting tmpfs to /tmp, or creating a separate partition for /tmp.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v mount >/dev/null 2>&1 || { echo "step1: mount not installed"; return 1; }; o=$(bash -c 'mount | grep -E '"'"'\s/tmp\s'"'"'' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)' || { echo step1: missing 'tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)'; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled tmp.mount' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- static || { echo step2: missing static; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run the following commands to configure mount options systemctl edit tmp.mount Edit the file to define the options that needs to be set. For example: [Mount] Options= Options=mode=1777,strictatime,noexec,nodev,nosuid Restart the tmp.mount systemctl daemon-reload # might be optional systemctl restart tmp.mount /etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: container-optimized-oscos
Référence: CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.1.2 Ensure /tmp is configured

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target cos