documentation_complete: true

title: 'Add nosuid Option to /tmp'

description: |-
    The <tt>nosuid</tt> mount option can be used to prevent execution of setuid programs in <tt>/tmp</tt>.
    The SUID and SGID permissions should not be required in these world-writable directories.
    <mount-desc-macro option="nosuid" part="/tmp" />

rationale: |-
    The presence of SUID and SGID executables should be tightly controlled.
    Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

severity: unknown

references:
    cis: 1.1.3
    nist: 'CM-7, MP-2'
