Vulnerability Discussion

The "noexec" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for nonprivileged users to attain unauthorized administrative access.

Check

Verify "/dev/shm" is mounted with the "noexec" option with the following command:

$ findmnt /dev/shm
TARGET SOURCE FSTYPE OPTIONS
/dev/shm tmpfs tmpfs rw,nodev,nosuid,noexec,seclabel 0 0

If the /dev/shm file system is mounted without the "noexec" option, this is a finding.

Fix

Configure "/dev/shm" to mount with the "noexec" option.

Determine how /dev/shm is managed.

$ systemctl status systemd-tmpfiles-setup
If "active", systemd is managing temporary files (including /dev/shm).
Otherwise, /etc/fstab is managing temporary files.

If systemd is managing /dev/shm, use the following commands to add the noexec option to the mount:
If /etc/tmpfiles.d does not exist, create it:
$ sudo mkdir -p /etc/tmpfiles.d

Add a configuration file with the appropriate options for /dev/shm as follows:
$ echo 'd /dev/shm 1777 root root 10d' | sudo tee /etc/tmpfiles.d/dev-shm.conf
$ echo 'x /dev/shm' | sudo tee -a /etc/tmpfiles.d/dev-shm.conf

Apply new mount options with the following commands:
$ sudo systemctl mask tmp.mount
Created symlink /etc/systemd/system/tmp.mount ? /dev/null.

$ echo 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,seclabel 0 0' | sudo tee -a /etc/fstab
$ sudo mount -o remount /dev/shm
$ sudo systemctl daemon-reload

If /dev/shm is managed by /etc/fstab, use the following commands to add the noexec option to the mount:
$ sudo vi /etc/fstab

Add or modify the following line:
tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,seclabel 0 0

Remount /dev/shm:
$ sudo mount -o remount /dev/shm

Note: Although systemd manages tmpfs mounts by default, administrators can override settings by adding entries to /etc/fstab. Either approach is acceptable.