Partitions

Our hardened Linux VM images use a single-partition layout. As such, the following controls, which require dedicated partitions, are excluded from hardened VM images.

  • CIS 1.1.2.1.1: Ensure a separate partition exists for /tmp

  • CIS 1.1.2.1.2: Ensure the nodev option is set on /tmp

  • CIS 1.1.2.1.3: Ensure the nosuid option is set on /tmp

  • CIS 1.1.2.1.4: Ensure the noexec option is set on /tmp

  • CIS 1.1.2.3.1: Ensure a separate partition exists for /home

  • CIS 1.1.2.3.2: Add the nodev option to /home

  • CIS 1.1.2.4.1: Ensure a separate partition exists for /var

  • CIS 1.1.2.4.2: Add the nodev option to /var

  • CIS 1.1.2.5.1: Ensure a separate partition exists for /var/temp

  • CIS 1.1.2.5.2: Add nodev option to /var/tmp

  • CIS 1.1.2.6.1: Ensure a separate partition exists for /var/log

  • CIS 1.1.2.6.2: Add the nodev option to /var/log

  • CIS 1.1.2.7.1: Ensure a separate partition exists for /var/log/audit

  • CIS 1.1.2.7.2: Add the nodev option to /var/log/audit

  • CIS 1.1.2.1: Configure /tmp

    • CIS 1.1.2.1.1: Ensure /tmp is a separate partition

    • CIS 1.1.2.1.2: Ensure nodev option set on the /tmp partition

    • CIS 1.1.2.1.3: Ensure nosuid option set on on the /tmp partition

    • CIS 1.1.2.1.4: Ensure noexec option set on on the /tmp partition

  • CIS 1.1.2.2: Configure /dev/shm

    • CIS 1.1.2.2.1: Ensure /dev/shm is a separate partition

    • CIS 1.1.2.2.2: Ensure nodev option set on the /dev/shm partition

    • CIS 1.1.2.2.3: Ensure nosuid option set on the /dev/shm partition

    • CIS 1.1.2.2.4: Ensure noexec option set on the /dev/shm partition

  • CIS 1.1.2.3: Configure /home

    • CIS 1.1.2.3.1: Ensure separate partition exists for /home

    • CIS 1.1.2.3.2: Ensure nodev option set on the /home partition

    • CIS 1.1.2.3.3: Ensure nosuid option set on the /home partition

  • CIS 1.1.2.4: Configure /var

    • CIS 1.1.2.4.1: Ensure separate partition exists for /var

    • CIS 1.1.2.4.2: Ensure nodev option set on the /var partition

    • CIS 1.1.2.4.3: Ensure nosuid option set on the /var partition

  • CIS 1.1.2.5: Configure /var/tmp

    • CIS 1.1.2.5.1: Ensure separate partition exists for the /var/tmp

    • CIS 1.1.2.5.2: Ensure nodev option set on the /var/tmp partition

    • CIS 1.1.2.5.3: Ensure nosuid option set on the /var/tmp partition

    • CIS 1.1.2.5.4: Ensure noexec option set on the /var/tmp partition

  • CIS 1.1.2.6: Configure /var/log

    • CIS 1.1.2.6.1: Ensure separate partition exists for /var/log

    • CIS 1.1.2.6.2: Ensure nodev option set on the /var/log partition

    • CIS 1.1.2.6.3: Ensure nosuid option set on the /var/log partition

    • CIS 1.1.2.6.4: Ensure noexec option set on the /var/log partition

  • CIS 1.1.2.7: Configure /var/log/audit

    • CIS 1.1.2.7.1: Ensure separate partition exists for /var/log/audit

    • CIS 1.1.2.7.2: Ensure nodev option set on the /var/log/audit partition

    • CIS 1.1.2.7.3: Ensure nosuid option set on the /var/log/audit partition

    • CIS 1.1.2.7.4: Ensure noexec option set on the /var/log/audit partition

  • CIS 1.1.2.1.1: Ensure a separate partition exists for /tmp

  • CIS 1.1.2.1.2: Ensure the nodev option is set on /tmp

  • CIS 1.1.2.1.3: Ensure the nosuid option is set on /tmp

  • CIS 1.1.2.1.4: Ensure the noexec option is set on /tmp

  • CIS 1.1.2.3.1: Ensure a separate partition exists for /home

  • CIS 1.1.2.3.2: Add the nodev option to /home

  • CIS 1.1.2.3.3: Add the nosuid option to /home

  • CIS 1.1.2.4.1: Ensure a separate partition exists for /var

  • CIS 1.1.2.4.2: Add the nodev option to /var

  • CIS 1.1.2.4.3: Add the nosuid option to /var

  • CIS 1.1.2.5.2: Add the nodev option to /var/temp

  • CIS 1.1.2.5.3: Add the nosuid option to /var/tmp

  • CIS 1.1.2.5.4: Add the noexec option to /var/tmp

  • CIS 1.1.2.6.1: Ensure a separate partition exists for /var/log

  • CIS 1.1.2.6.2: Add the nodev option to /var/log

  • CIS 1.1.2.6.3: Add the nosuid option to /var/log

  • CIS 1.1.2.6.4: Add the nexec option to /var/log

  • CIS 1.1.2.7.1: Ensure a separate partition exists for /var/log/audit

  • CIS 1.1.2.7.2: Add the nodev option to /var/log/audit

  • CIS 1.1.2.7.3: Add the nosuid option to /var/log/audit

  • CIS 1.1.2.7.4: Add the noexec option to /var/log/audit

CIS 1.1.2: Configure Filesystem Partitions

  • CIS 1.1.2.1: Configure /tmp

    • CIS 1.1.2.1.1: Ensure /tmp is a separate partition

    • CIS 1.1.2.1.2: Ensure the nodev option is set on the /tmp partition

    • CIS 1.1.2.1.3: Ensure the nosuid option is set on the /tmp partition

    • CIS 1.1.2.1.4: Ensure the noexec option is set on the /tmp partition

  • CIS 1.1.2.3: Configure /home

    • CIS 1.1.2.3.1: Ensure a separate partition exists for /home

    • CIS 1.1.2.3.2: Ensure the nodev option is set on the /home partition

    • CIS 1.1.2.3.3: Ensure the nosuid option is set on the /home partition

  • CIS 1.1.2.4: Configure /var

    • CIS 1.1.2.4.1: Ensure a separate partition exists for /var

    • CIS 1.1.2.4.2: Ensure the nodev option is set on the /var partition

    • CIS 1.1.2.4.3: Ensure the nosuid option is set on the /var partition

  • CIS 1.1.2.5: Configure /var/tmp

    • CIS 1.1.2.5.1: Ensure a separate partition exists for /var/tmp

    • CIS 1.1.2.5.2: Ensure the nodev option is set on the /var/tmp partition

    • CIS 1.1.2.5.3: Ensure the nosuid option is set on the /var/tmp partition

    • CIS 1.1.2.5.4: Ensure the noexec option is set on the /var/tmp partition

  • CIS 1.1.2.6: Configure /var/log

    • CIS 1.1.2.6.1: Ensure a separate partition exists for /var/log

    • CIS 1.1.2.6.2: Ensure the nodev option is set on the /var/log partition

    • CIS 1.1.2.6.3: Ensure the nosuid option is set on the /var/log partition

    • CIS 1.1.2.6.4: Ensure the noexec option is set on the /var/log partition

  • CIS 1.1.2.7: Configure /var/log/audit

    • CIS 1.1.2.7.1: Ensure a separate partition exists for /var/log/audit

    • CIS 1.1.2.7.2: Ensure the nodev option is set on the /var/log/audit partition

    • CIS 1.1.2.7.3: Ensure the nosuid option is set on the /var/log/audit partition

    • CIS 1.1.2.7.4: Ensure the noexec option is set on the /var/log/audit partition