/tmp mount options
medium on-server
What it inspects
`findmnt /tmp -no OPTIONS`. If /tmp is not a separate mount it warns; if it is mounted but lacks noexec or nosuid it warns and names the missing option; with both it passes. The nodev option is not checked. This check never fails, it only warns.
Why it matters
/tmp is writable by everyone, so it is where attackers drop and run tools after a first foothold (a web shell, a compromised service). Mounting it noexec and nosuid makes that harder and takes away SUID tricks. The cost is that some installers and build tools expect to run files from /tmp, so it is worth testing.
How to verify
findmnt /tmp -no OPTIONSHow to fix
Judgement step: mount /tmp as a tmpfs (systemd tmp.mount or an fstab line) with noexec,nosuid,nodev, after checking that nothing you run needs to execute from /tmp.
Mount /tmp with noexec and nosuid needs your judgement
Any distro
# Mounting /tmp with noexec and nosuid stops programs from being run out of a world-writable directory.
# It can break installers and tools that unpack and run code from /tmp (some language package builds, Java and Node tooling),
# so test on a non-production copy first and be ready to undo it. Pick ONE route:
#
# A) systemd tmpfs mount (RAM-backed, emptied at every reboot).
# If /usr/lib/systemd/system/tmp.mount does not exist, first copy the example unit:
# cp /usr/share/systemd/tmp.mount /etc/systemd/system/tmp.mount
# Then:
# systemctl edit tmp.mount
# and add these lines (Options must repeat the full list, because it replaces the shipped value):
# [Mount]
# Options=mode=1777,strictatime,nosuid,nodev,noexec,size=50%%
# # %% is how systemd unit files write a literal %
# then: systemctl enable tmp.mount && systemctl start tmp.mount
# Whenever the tmpfs is mounted (now, and at every boot) it hides whatever /tmp holds on the root filesystem;
# applications holding files there may fail.
#
# B) A line in /etc/fstab (use a tmpfs, or an existing partition):
# tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev,size=2G,mode=1777 0 0
# then reboot, or run `mount /tmp` in a quiet period. To change options on a mount that already exists:
# mount -o remount,noexec,nosuid,nodev /tmp
#
# Check the result: findmnt /tmp -no OPTIONS (this check needs both noexec and nosuid in the list).
# Common breakage with noexec /tmp: apt and debconf run package configuration scripts from /tmp, and they then fail.
# Point apt at another directory by adding this line to a file in /etc/apt/apt.conf.d/:
# APT::ExtractTemplates::TempDir "/var/tmp";
# Other tools that need to execute from /tmp can usually be pointed elsewhere with TMPDIR=/var/tmp for that one command.