Mount /dev/shm with nodev, nosuid and noexec

Description

/dev/shm is the tmpfs used for POSIX shared memory. systemd mounts it at boot with nodev and nosuid. This control also requires noexec, set through a /dev/shm line in /etc/fstab that systemd applies at boot.

Rationale

Every user can write to /dev/shm, and its content never reaches the disk. Attackers use it to store and run tools while leaving few traces. noexec blocks direct execution, nosuid and nodev stop setuid files and device nodes placed there from being used.

Impact

Programs that map executable code from files in /dev/shm fail. This is rare (some JIT engines and old database software); check vendor requirements before applying on such systems.

Setting

Audit

Run findmnt -kn /dev/shm. Its options must contain nodev, nosuid and noexec.

Automated: every check must pass. Scanners report each check by its id.

mount

/dev/shm is a mount point and its options include nodev, nosuid and noexec.

script: |
  o=$(findmnt -kn -o SOURCE,FSTYPE,OPTIONS --mountpoint /dev/shm | tail -n 1)
  [ -n "$o" ] || { echo "/dev/shm is not mounted"; exit 1; }
  echo "/dev/shm $o"
  rc=0
  for opt in nodev nosuid noexec; do
    case ,${o##* }, in *,$opt,*) ;; *) echo "missing $opt"; rc=1 ;; esac
  done
  exit $rc

Remediation

1. If /etc/fstab has a /dev/shm line, add nodev,nosuid,noexec to its options. Otherwise add the line:

   tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0
   

2. Run systemctl daemon-reload and mount -o remount,nodev,nosuid,noexec /dev/shm.

Rollback

Remove the /dev/shm line from /etc/fstab (or restore the copy saved in the backup directory), run systemctl daemon-reload and mount -o remount,exec /dev/shm.

fstab

# CB-DEB-FS-004: mount /dev/shm with nodev, nosuid and noexec, at once and at every boot.
f=/etc/fstab
cb_backup "$f"
if awk '$1 !~ /^#/ && $2 == "/dev/shm"' "$f" | grep -q .; then
  # Add the missing options to the existing line, leave every other line untouched.
  awk '$1 !~ /^#/ && $2 == "/dev/shm" {
         n = split("nodev nosuid noexec", w, " ")
         for (i = 1; i <= n; i++) if (index("," $4 ",", "," w[i] ",") == 0) $4 = $4 "," w[i]
       }
       { print }' "$f" >"$f.cirsec.tmp" || { rm -f "$f.cirsec.tmp"; exit 1; }
  cat "$f.cirsec.tmp" >"$f"
  rm -f "$f.cirsec.tmp"
else
  printf 'tmpfs\t/dev/shm\ttmpfs\tdefaults,nodev,nosuid,noexec\t0\t0\n' >>"$f"
fi
systemctl daemon-reload
mount -o remount,nodev,nosuid,noexec /dev/shm

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• fstab(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemd-fstab-generator(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• mount(8), Debian manual pages (filesystem-independent mount options) Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-FS-003 Mount /tmp as a separate filesystem with nodev, nosuid and noexec

People and lifecycle