documentation_complete: true

prodtype: rhel7,fedora,ol7

title: 'Add nosuid Option to /dev/shm'

description: |-
    The <tt>nosuid</tt> mount option can be used to prevent execution
    of setuid programs in <tt>/dev/shm</tt>.  The SUID and SGID permissions should not
    be required in these world-writable directories.
    <mount-desc-macro option="nosuid" part="/dev/shm" />

rationale: |-
    The presence of SUID and SGID executables should be tightly controlled. Users
    should not be able to execute SUID or SGID binaries from temporary storage partitions.

severity: unknown

identifiers:
    cce@rhel7: 80154-8

references:
    cis: 1.1.16
    nist: CM-7,MP-2
