Within this series of posts we will go through all the Oracle
Linux 7 CIS benchmark controls and outline them a bit more than might have been
done on the actual CIS benchmark.
control : Create Separate Partition for /tmp
The rational behind this control is : Since the /tmp
directory is intended to be world-writable, there is a risk of resource
exhaustion if it is not bound to a separate partition. In addition, making /tmp
its own file system allows an administrator to set the noexec option on the
mount, making /tmp useless for an attacker to install executable code. It would
also prevent an attacker from establishing a hardlink to a system setuid
program and wait for it to be updated. Once the program was updated, the
hardlink would be broken and the attacker would have his own copy of the
program. If the program happened to have a security vulnerability, the attacker
could continue to exploit the known flaw.
What this in effect means is: that if an attacker would be
able to flood /tmp with “junk” data it could lead to a situation where your
system disks are full and the operating system is unable to function in the way
it should. Additionally, as /tmp is a place most users will be able to write
data to an attacker could also write scripts and code to it. As it provides a
place to store code it can be abused from that point of view. If you allow
users to write to the /tmp space however disallow them to execute code that is
stored in /tmp this takes away this specific risk of code execution for code
stored in /tmp.
The CIS benchmark provides the below standard code to verify
if you have a separate /tmp in place:
grep "[[:space:]]/tmp[[:space:]]" /etc/fstab
Even though this check works the below might be a bit smarter
and will provide a pass or fail result based upon the check:
#!/bin/bash grep "[[:space:]]/tmp[[:space:]]" /etc/fstab | wc -l&> /dev/null if [ $? == 0 ]; then echo "fail" else echo "pass" fi
In effect the above will do the same as the check promoted
in the CIS benchmark document, however, it might be easier to include in a
programmatic check. In case /tmp is not a separate file system it will return a
fail on this control.
