documentation_complete: true

title: 'Add nodev Option to Removable Media Partitions'

description: |-
    The <tt>nodev</tt> mount option prevents files from being interpreted as character or block devices.
    Legitimate character and block devices should exist only in the <tt>/dev</tt> directory on the root partition or within chroot jails built for system services.
    <mount-desc-macro option="nodev" part="any removable media partitions" />

rationale: |-
    The only legitimate location for device files is the <tt>/dev</tt> directory located on the root partition.
    An exception to this is chroot jails, and it is not advised to set <tt>nodev</tt> on partitions which contain their root filesystems.

severity: unknown

references:
    nist: AC-19(a),AC-19(d),AC-19(e),CM-7,MP-2
