In the previous section,

Disabling Unnecessary Filesystem Modules

was completed.

CIS Benchmark Requirements (Section 1.1.2)

This article covers and implements the following sections of the CIS standard:

• 1.1.2.1 Configure /tmp (Separate partition, nodev, nosuid, noexec)
• 1.1.2.2 Configure /dev/shm (Separate partition, nodev, nosuid, noexec)
• 1.1.2.3 Configure /home (Separate partition, nodev, nosuid)
• 1.1.2.4 Configure /var (Separate partition, nodev, nosuid)
• 1.1.2.5 Configure /var/tmp (Separate partition, nodev, nosuid, noexec)
• 1.1.2.6 Configure /var/log (Separate partition, nodev, nosuid, noexec)
• 1.1.2.7 Configure /var/log/audit (Separate partition, nodev, nosuid, noexec)

1. Concept & Rationale

Why separate partitions?

In security standards, directories where regular users have write access (such as /tmp and /dev/shm) or where variable system data is stored (such as /var and /var/log) must be separated from the root partition (/). This prevents resource exhaustion (disk space filling up), which can lead to system services crashing.

Critical Note: The requirement for "separate partitions" must be planned and implemented during the OS Installation phase. Separating key partitions like /var after Linux has been installed is a high-risk process that requires booting the system into Rescue Mode and migrating data manually. The scripts in this article will only work if the partitions have already been separated beforehand.

Why Mount Options restrictions?

Once partitioned, the following restrictions must be applied to these mount points to reduce the attack surface:

• nodev (No Devices): Prevents the creation and use of malicious character or block device files on these partitions.
• nosuid (No SetUID): Ignores SUID/SGID bits. Prevents executing files with the owner's privileges (avoiding privilege escalation to root).
• noexec (No Execution): Prevents running scripts or binaries directly. This is highly effective in stopping malware execution in temporary directories.

2. Compatibility with Oracle Database (Updated)

Potential Conflicts & Solutions:

Applying the noexec option to the /tmp and /var/tmp partitions will disrupt the installation of Oracle products (Database and Grid Infrastructure) as well as the patching process (via OPatch). This is because Oracle extracts and executes installation scripts, shared libraries (.so files), and temporary binaries in these directories.

Furthermore, as mentioned earlier, applying noexec to /dev/shm will cause a complete crash of the database and Oracle RAC due to the Automatic Memory Management (AMM/ASMM) mechanism. This exception is permanently configured in the script.

Workaround for DBAs (Installation & Patching Operations):

During initial installations or periodic patching (RU/RUR), the system administrator or DBA must temporarily remove the execution restriction, and re-apply it once the operations are complete:

# Before Oracle Installation/Patching:
mount -o remount,exec /tmp
mount -o remount,exec /var/tmp

# After completion:
mount -o remount,noexec /tmp
mount -o remount,noexec /var/tmp

3. How to Audit the Current Status (Audit Script)

This script checks the status of separate partitions and verifies whether the security mount options are applied:

Link to this script on GitHub:

modules/audit_02_Configure_Mount_Options.sh

If you are not familiar with Bash scripting, you can refer to the tutorial I have published on the website for DBAs.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_1_2.sh
# Purpose: Audit Filesystem Partitions and Mount Options (CIS 1.1.2 - 1.1.8)

FAIL_COUNT=0

echo -e "\n=========================================================================="
echo -e "[+] AUDIT: CIS 1.1.2 to 1.1.8 - Partitions & Mount Options"
echo -e "--------------------------------------------------------------------------"
echo -e "CIS Requirement : Separate partitions for /tmp, /dev/shm, /home, /var,"
echo -e " /var/tmp, /var/log, /var/log/audit."
echo -e " Mount options: nodev, nosuid, noexec (where applicable)."
echo -e "Oracle Context : CRITICAL EXCEPTION! /dev/shm MUST NOT have 'noexec'."
echo -e " Oracle DB/RAC requires execution rights on /dev/shm."
echo -e " /tmp also might need exec during Oracle installation,"
echo -e " but can be noexec post-install. Assuming post-install."
echo -e "==========================================================================\n"

# Format: "Partition:Required_Options"
declare -A PART_REQS=(
["/tmp"]="nodev,nosuid,noexec"
["/dev/shm"]="nodev,nosuid" # EXCEPTION: noexec is omitted for Oracle
["/home"]="nodev,nosuid"
["/var"]="nodev,nosuid"
["/var/tmp"]="nodev,nosuid,noexec"
["/var/log"]="nodev,nosuid,noexec"
["/var/log/audit"]="nodev,nosuid,noexec"
)

for part in "${!PART_REQS[@]}"; do
req_opts="${PART_REQS[$part]}"
MOUNT_INFO=$(findmnt -n -o OPTIONS "$part" 2>/dev/null)

if [ -z "$MOUNT_INFO" ]; then
echo -e " [FAIL] $part is NOT a separate partition!"
FAIL_COUNT=$((FAIL_COUNT + 1))
else
# Check each required option
IFS=',' read -ra OPTS <<< "$req_opts"
MISSING_OPTS=""
for opt in "${OPTS[@]}"; do
if ! echo "$MOUNT_INFO" | grep -qw "$opt"; then
MISSING_OPTS="$MISSING_OPTS $opt"
fi
done

if [ -n "$MISSING_OPTS" ]; then
echo -e " [FAIL] $part exists but missing options:$MISSING_OPTS (Current: $MOUNT_INFO)"
FAIL_COUNT=$((FAIL_COUNT + 1))
else
echo -e " [PASS] $part exists with secure options ($req_opts)"
fi
fi
done

echo -e "--------------------------------------------------------------------------"
if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "[+] AUDIT RESULT: PASSED (All partitions and mount options are secure.)\n"
exit 0
else
echo -e "[-] AUDIT RESULT: FAILED ($FAIL_COUNT issue(s) detected.)\n"
exit 1
fi

4. How to Apply Settings (Remediation Bash Script)

This script adds security options to /etc/fstab and utilizes the systemd configuration in Oracle Linux 9 for /tmp. (This assumes that the partitions have already been created).

Link to this script on GitHub:

modules/remediate_02_Configure_Mount_Options.sh

#!/bin/bash
# Script: remediate_cis_1_1_2.sh
# Purpose: Apply Secure Mount Options (CIS 1.1.2 - 1.1.8)

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo -e "\n[+] Applying Remediation for Partitions & Mount Options..."
echo -e "[!] Note: Skipping 'noexec' on /dev/shm for Oracle compatibility.\n"

# 3. Function to update /etc/fstab safely
update_fstab() {
local mount_point=$1
local options=$2

if grep -q "^[^#].*[[:space:]]${mount_point}[[:space:]]" /etc/fstab; then
for opt in $(echo "$options" | tr ',' ' '); do
sed -i "/^[[:space:]]*[^#].*[[:space:]]${mount_point//\//\\/}[[:space:]]/ s/\([ \t]*[^\t ]*[ \t]*[^\t ]*[ \t]*[^\t ]*[ \t]*\)\([^ \t]*\)/\1\2,$opt/" /etc/fstab
done
sed -i "/^[[:space:]]*[^#].*[[:space:]]${mount_point//\//\\/}[[:space:]]/ s/,\{2,\}/,/g" /etc/fstab
sed -i "/^[[:space:]]*[^#].*[[:space:]]${mount_point//\//\\/}[[:space:]]/ s/,[ \t]/ /g" /etc/fstab
mount -o remount "$mount_point" 2>/dev/null
echo " [+] Updated options for $mount_point"
else
echo " [-] WARNING: $mount_point is not in /etc/fstab (requires architectural change)."
fi
}

# 1. Configure /tmp (Check fstab first, fallback to systemd)
echo " [*] Configuring /tmp..."
if grep -q "^[^#].*[[:space:]]/tmp[[:space:]]" /etc/fstab; then
update_fstab "/tmp" "nodev,nosuid,noexec"
else
echo " Using systemd (tmpfs) for /tmp..."
cp /usr/lib/systemd/system/tmp.mount /etc/systemd/system/ 2>/dev/null
sed -i 's/^Options=.*/Options=mode=1777,strictatime,noexec,nodev,nosuid/' /etc/systemd/system/tmp.mount
systemctl daemon-reload
systemctl enable tmp.mount --now
mount -o remount /tmp 2>/dev/null
fi

# 2. Fix /dev/shm (Add to fstab explicitly for Oracle)
echo " [*] Configuring /dev/shm explicitly for Oracle..."
if ! grep -q "^tmpfs[[:space:]]*/dev/shm" /etc/fstab; then
echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,seclabel 0 0" >> /etc/fstab
else
sed -i -E 's|^(tmpfs[[:space:]]+/dev/shm[[:space:]]+tmpfs[[:space:]]+)([^[:space:]]+)|\1defaults,nodev,nosuid,seclabel|' /etc/fstab
fi
mount -o remount /dev/shm 2>/dev/null

# Update other partitions
update_fstab "/home" "nodev,nosuid"
update_fstab "/var" "nodev,nosuid"
update_fstab "/var/tmp" "nodev,nosuid,noexec"
update_fstab "/var/log" "nodev,nosuid,noexec"
update_fstab "/var/log/audit" "nodev,nosuid,noexec"

echo -e "\n[+] Mount options hardening completed."

In the next part, we will discuss

Securing Package Management and Local Repositories

...