documentation_complete: true

title: 'Add nodev Option to /tmp'

description: |-
    The <tt>nodev</tt> mount option can be used to prevent device files from
    being created in <tt>/tmp</tt>.
    Legitimate character and block devices should not exist
    within temporary directories like <tt>/tmp</tt>.
    <mount-desc-macro option="nodev" part="/tmp" />

rationale: |-
    The only legitimate location for device files is the <tt>/dev</tt> directory located on the root partition.
    The only exception to this is chroot jails.

severity: unknown

references:
    cis: 1.1.2
    nist: 'CM-7, MP-2'
