SV-217846r603264: The system must use a separate file system for /tmp. | Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must use a separate file system for /tmp.

Description

Discussion Text

The "/tmp" partition is used as temporary storage by many programs. Placing "/tmp" in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366CCE-26435-8V-38455SV-50255

References

DPMS Target Red Hat Enterprise Linux 6 DISA DPMS Target Red Hat Enterprise Linux 6 4046

Checks

DISA STIG (Manual Reference)

Run the following command to determine if "/tmp" is on its own partition or logical volume: 

$ mount | grep "on /tmp "

If "/tmp" has its own partition or volume group, a line will be returned. 
If no line is returned, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.redhat.rhel6:def:1183
# The system must use a separate file system for /tmp.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# /tmp on own partition
# partition_object (partition_test)
test_1() {
  findmnt -n -o FSTYPE,OPTIONS /tmp &>/dev/null
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL mil.disa.fso.redhat.rhel6:def:1183
if [ -n "$(stat -f /tmp 2>/dev/null | awk '/fsize/ {print $1}')" ] && [ "$(stat -f /tmp 2>/dev/null | awk '/ftype/ {print $2}' | grep -c '^tmpfs')" -eq 0 ]; then echo "FAIL"; exit 1; fi; echo "PASS"; exit 0

Remediation

The "/tmp" directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.