2.16 Add noexec Option to /run/shm Partition

Information

Set noexec on the shared memory partition to prevent programs from executing from there. Setting this option on a file system prevents users from executing programs from shared memory. This deters users from introducing potentially malicious software on the system.

Solution

Edit the /etc/fstab file and add noexec to the fourth field (mounting options). Look for entries that have mount points that contain /run/shm. See the fstab(5) manual page for more information. # mount -o remount,noexec /run/shm

See Also

https://workbench.cisecurity.org/files/85

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv6|3.1, CSCv7|5.1

Plugin: Unix

Control ID: d5d908dc6b8a1d89a84e85bfdaa0396b5d93945822d0c9f1ab70ed1ab2f5c50a