documentation_complete: true

title: 'Add noexec Option to Removable Media Partitions'

description: |-
    The <tt>noexec</tt> mount option prevents the direct execution of binaries on the mounted filesystem.
    Preventing the direct execution of binaries from removable media (such as a USB key) provides a defense against malicious software that may be present on such untrusted media.
    <mount-desc-macro option="noexec" part="any removable media partitions" />

rationale: 'Allowing users to execute binaries from removable media such as USB keys exposes the system to potential compromise.'

severity: unknown

references:
    cis: 1.1.12
    disa: 87
    nist: AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2

ocil_clause: 'removable media partitions are present'

ocil: |-
    To verify that binaries cannot be directly executed from removable media, run the following command:
    <pre>$ grep -v noexec /etc/fstab</pre>
    The resulting output will show partitions which do not have the <tt>noexec</tt> flag.
    Verify all partitions in the output are not removable media.
