Title

RHEL 9 must mount /dev/shm with the noexec option. (Cat II impact)

Discussion

The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.

Check Content

Verify "/dev/shm" is mounted with the "noexec" option with the following command: $ findmnt /dev/shm TARGET SOURCE FSTYPE OPTIONS /dev/shm tmpfs tmpfs rw,nodev,nosuid,noexec,seclabel 0 0 If the /dev/shm file system is mounted without the "noexec" option, this is a finding.

Fix Text

Configure "/dev/shm" to mount with the "noexec" option. Determine how /dev/shm is managed. $ systemctl status systemd-tmpfiles-setup If "active", systemd is managing temporary files (including /dev/shm). Otherwise, /etc/fstab is managing temporary files. If systemd is managing /dev/shm, use the following commands to add the noexec option to the mount: If /etc/tmpfiles.d does not exist, create it: $ sudo mkdir -p /etc/tmpfiles.d Add a configuration file with the appropriate options for /dev/shm as follows: $ echo 'd /dev/shm 1777 root root 10d' | sudo tee /etc/tmpfiles.d/dev-shm.conf $ echo 'x /dev/shm' | sudo tee -a /etc/tmpfiles.d/dev-shm.conf Apply new mount options with the following commands: $ sudo systemctl mask tmp.mount Created symlink /etc/systemd/system/tmp.mount ? /dev/null. $ echo 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,seclabel 0 0' | sudo tee -a /etc/fstab $ sudo mount -o remount /dev/shm $ sudo systemctl daemon-reload If /dev/shm is managed by /etc/fstab, use the following commands to add the noexec option to the mount: $ sudo vi /etc/fstab Add or modify the following line: tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,seclabel 0 0 Remount /dev/shm: $ sudo mount -o remount /dev/shm Note: Although systemd manages tmpfs mounts by default, administrators can override settings by adding entries to /etc/fstab. Either approach is acceptable.

Additional Identifiers

Rule ID: SV-257864r1106304_rule

Vulnerability ID: V-257864

Group Title: SRG-OS-000368-GPOS-00154

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.