The /tmp directory is a critical system directory used for temporary storage by various users and applications. As a world-writable directory, it provides a shared space for files that are created and used by different processes during their execution. However, because of its open-write nature, the /tmp directory can pose security risks, if not properly configured.
To mitigate these risks and enhance system security, it is necessary to ensure that the /tmp directory is mounted with appropriate settings. Mounting /tmp can enforce additional protections, such as preventing users from writing executable files, enforcing access control policies, and reducing the likelihood of malicious users exploiting the directory. This is especially important for systems that require high security or handle sensitive data.
By confirming that /tmp is mounted and properly configured, as shown in the /proc/mounts file, administrators can ensure that the directory is operating with the desired security settings, preventing potential vulnerabilities related to temporary file storage.
To accomplish this, you will need to:
For more info, review the Prisma Defender documentation below:
Install a Single Host Defender
Prisma Cloud performs two checks to evaluate the configuration of the /tmp directory:
Active Mount Verification:
Prisma Cloud checks if /tmp is actively mounted by inspecting the system’s current mount points. This is done by querying the output of the mount command or by reading the /proc/mounts file. For example, it verifies that /tmp is mounted as a tmpfs (temporary file system) with the appropriate security options, such as nosuid, nodev, and seclabel, and that it has an adequate size and inode allocation.
A sample output might look like this:
[ec2-jabar@jabar~]$ mount | grep /tmp
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,seclabel,size=486136k,nr_inodes=1048576)
[ec2-jabar@jabar~]$ cat /proc/mounts | grep /tmp
tmpfs /tmp tmpfs rw,seclabel,nosuid,nodev,size=486136k,nr_inodes=1048576 0 0
Prisma Cloud also verifies that /tmp is correctly defined in the system’s /etc/fstab file, which dictates the persistent mount configuration for system directories. This check ensures that the system will consistently mount /tmp with the correct options upon reboot.
Prisma Cloud ensures that the /tmp directory is configured and mounted with the appropriate settings to prevent potential security risks by performing these checks.
Reproduction Image:
Figure 1 : Compliance ID 6112_PaloAltoNetworks
As shown in the screenshot, this discrepancy results in a "FAIL" in the evaluation, indicating that while the directory is mounted currently, it lacks a persistent configuration in /etc/fstab to ensure it remains mounted across system reboots.
Confirm /tmp is mounted with the command below:
[ec2-user@ip-172-31-27-111 ~]$ mount | grep /tmp
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,seclabel,size=486136k,nr_inodes=1048576)
The /tmp directory is indeed mounted as a tmpfs filesystem with the expected security options (rw, nosuid, nodev, seclabel) and the specified size and inode limits. However, the mount configuration for /tmp is not present in the /etc/fstab file, which means it is not set up for automatic mounting on system startup:
Added Mount Definition to /etc/fstab:
The first step is to define the /tmp mount in the /etc/fstab file to ensure it gets mounted automatically during system startup. The following entry was added to /etc/fstab:
[ec2-user@ip-172-31-27-111 ~]$ sudo more /etc/fstab
UUID=7b395683-8f97-49be-bc51-d7b52020feb2 / xfs defaults,noatime 1 1
UUID=53F8-484B /boot/efi vfat defaults,noatime,uid=0,gid=0,umask=0077,shortname=winnt,x-systemd.automount 0 2
tmpfs /tmp tmpfs defaults,noatime,nosuid,nodev 0 0
The added line ensures that the /tmp directory is mounted as a tmpfs file system with the appropriate security options (noatime, nosuid, nodev) and is configured to mount automatically on boot.
Re-mounted /tmp:
After modifying the /etc/fstab file, the system was instructed to apply the new mount configuration immediately by running:
sudo mount -a
This command forces the system to re-read the /etc/fstab file and mount any file systems that are not currently mounted, including the newly configured /tmp mount.
Re-scanned the Host:
Once the mount configuration was updated and applied, the host was re-scanned to verify the changes. The result of the scan now showed a PASS, indicating that the /tmp directory is correctly configured and mounted according to best practices.
Figure 2 : Compliance Rescan For ID 6112_PaloAltoNetworks
Ensuring that the /tmp directory is properly mounted is crucial for both system security and functionality. Here are the key reasons why:
In summary, mounting /tmp with appropriate options is essential for securing the system, ensuring proper operation of applications, maintaining performance, and safeguarding sensitive data.
Prisma Cloud plays a crucial role in ensuring that the /tmp directory is properly mounted and configured according to best security practices. By evaluating the mount status and verifying its configuration in both active mount points and the /etc/fstab file, Prisma Cloud helps ensure that the /tmp directory is securely mounted with the correct options, such as nosuid, nodev, and noexec. This not only prevents potential security vulnerabilities, such as unauthorized code execution or privilege escalation, but also ensures that the system's temporary file storage is consistent and properly managed across reboots.
Given that /tmp is a shared, world-writable directory used by various users and applications, Prisma Cloud’s automated checks and monitoring provide essential visibility and enforcement of system hardening requirements. This proactive approach minimizes risks, improves system reliability, and enhances overall security posture by ensuring that /tmp is correctly configured and compliant with organizational and regulatory standards. In this way, Prisma Cloud is an essential tool in maintaining the integrity and safety of system environments.
