ComplianceAsCode / ComplianceAsCode/content
Test for mount-options on `/tmp` are incomplete
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Remediation- and scan-profiles don't know how to deal with systems where `/tmp` is a pseudofilesystem (managed by the `tmp.mount` systemd service).
#### SCAP Security Guide Version:
0.1.68
#### Operating System Version:
Red Hat 8.8
#### Steps to Reproduce:
1. Install compliance-as-code tooling on RHEL 8 system configured with the `tmp.mount` service enabled
2. Executed the bundled remediation automation-content
3. Reboot system
4. Perform a compliance scan
5. Receive a scan-report calling out `/tmp` missing the required mount-option
#### Actual Results:
Scan-results call out call out `/tmp` missing the required mount-option
#### Expected Results:
Scan-results should not call out call out `/tmp` missing the required mount-option
#### Additional Information/Debugging Steps:
Instead of testing _just_ `/etc/fstab`, scan should also test for actual mount-options in `/proc/mounts` and any specified in systemd file, `/etc/systemd/system/tmp.mount.d/options.conf`
Recommended additions:
1. Check for presence of an `/etc/systemd/system/tmp.mount.d/options.conf` file
1. If `/etc/systemd/system/tmp.mount.d/options.conf` file exists, check requested mount-options:
~~~bash
# cat /etc/systemd/system/tmp.mount.d/options.conf
[Mount]
Options=mode=1777,strictatime,nosuid,noexec,nodev
~~~
Contributor guide
Assessment
This issue has not been assessed yet.