documentation_complete: true

title: 'Add noexec Option to /tmp'

description: |-
    The <tt>noexec</tt> mount option can be used to prevent binaries
    from being executed out of <tt>/tmp</tt>.
    <mount-desc-macro option="noexec" part="/tmp" />

rationale: |-
    Allowing users to execute binaries from world-writable directories
    such as <tt>/tmp</tt> should never be necessary in normal operation and
    can expose the system to potential compromise.

severity: unknown

identifiers:
    cce: 26720-3

references:
    disa: 381
    nist: CM-7,MP-2
    srg: SRG-OS-999999
    stigid: RHEL-06-000528
