DISA STIGS Viewer

Finding ID	Version	Rule ID	IA Controls	Severity
V-257864	RHEL-09-231115	SV-257864r1106304_rule		Medium

Description

The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.

STIG	Date
Red Hat Enterprise Linux 9 Security Technical Implementation Guide	2025-05-14

Check Text (C-61605r1102006_chk)

Verify "/dev/shm" is mounted with the "noexec" option with the following command: $ findmnt /dev/shm TARGET SOURCE FSTYPE OPTIONS /dev/shm tmpfs tmpfs rw,nodev,nosuid,noexec,seclabel 0 0 If the /dev/shm file system is mounted without the "noexec" option, this is a finding.

Fix Text (F-61529r1106303_fix)

Configure "/dev/shm" to mount with the "noexec" option. Determine how /dev/shm is managed. $ systemctl status systemd-tmpfiles-setup If "active", systemd is managing temporary files (including /dev/shm). Otherwise, /etc/fstab is managing temporary files. If systemd is managing /dev/shm, use the following commands to add the noexec option to the mount: If /etc/tmpfiles.d does not exist, create it: $ sudo mkdir -p /etc/tmpfiles.d Add a configuration file with the appropriate options for /dev/shm as follows: $ echo 'd /dev/shm 1777 root root 10d' | sudo tee /etc/tmpfiles.d/dev-shm.conf $ echo 'x /dev/shm' | sudo tee -a /etc/tmpfiles.d/dev-shm.conf Apply new mount options with the following commands: $ sudo systemctl mask tmp.mount Created symlink /etc/systemd/system/tmp.mount ? /dev/null. $ echo 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,seclabel 0 0' | sudo tee -a /etc/fstab $ sudo mount -o remount /dev/shm $ sudo systemctl daemon-reload If /dev/shm is managed by /etc/fstab, use the following commands to add the noexec option to the mount: $ sudo vi /etc/fstab Add or modify the following line: tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,seclabel 0 0 Remount /dev/shm: $ sudo mount -o remount /dev/shm Note: Although systemd manages tmpfs mounts by default, administrators can override settings by adding entries to /etc/fstab. Either approach is acceptable.