documentation_complete: true

title: 'Add nodev Option to Non-Root Local Partitions'

description: |-
    The <tt>nodev</tt> mount option prevents files from being interpreted as character or block devices.
    Legitimate character and block devices should exist only in the <tt>/dev</tt> directory on the root partition or within chroot jails built for system services.
    <mount-desc-macro option="nodev" part="any non-root local partitions" />

rationale: |-
    The <tt>nodev</tt> mount option prevents files from being interpreted as character or block devices.
    The only legitimate location for device files is the <tt>/dev</tt> directory located on the root partition.
    The only exception to this is chroot jails, for which it is not advised to set <tt>nodev</tt> on these filesystems.

severity: unknown

references:
    cis: 1.1.11
    nist: CM-7
