documentation_complete: true

title: 'Add noexec Option to /tmp'

description: |-
    The <tt>noexec</tt> mount option can be used to prevent binaries from being executed out of <tt>/tmp</tt>.
    <mount-desc-macro option="noexec" part="/tmp" />

rationale: 'Allowing users to execute binaries from world-writable directories such as <tt>/tmp</tt> should never be necessary in normal operation and can expose the system to potential compromise.'

severity: unknown

references:
    cis: 1.1.4
    nist: 'CM-7, MP-2'
