RHEL9-CIS-Audit/section_1/cis_1.1/cis_1.1.4.3_4.yml

{{ if .Vars.rhel9cis_level_1 }}
  {{ if .Vars.rhel9cis_rule_1_1_4_1 }}
mount:
  /var/tmp:
    title: |
        1.1.4.3 | Ensure noexec option set on /var/tmp partition
        1.1.4.4 | Ensure nosuid option set on /var/tmp partition
    exists: true
    opts:
    {{ if .Vars.rhel9cis_rule_1_1_4_3 }}
    - noexec
    {{ end }}
    {{ if .Vars.rhel9cis_rule_1_1_4_4 }}
    - nosuid
    {{ end }}
    meta:
      server: 1
      workstation: 1
      CIS_ID:
      - 1.1.4.3
      - 1.1.4.4
      CISv8: 3.3
      CISv8_IG1: true
      CISv8_IG2: true
      CISv8_IG3: true
command:
  {{ if .Vars.rhel9cis_rule_1_1_4_3 }}
  noexec_var_tmp_fstab:
     title: 1.1.4.3 | Ensure noexec option set on /var/tmp partition | fstab config
     exec: grep '.*\/var\/tmp\s.*noexec.*$' \/etc\/fstab
     exit-status:
       or:
       - 0
       - 1
     stdout:
     - '/.*\/var\/tmp\s.*noexec.*$/'
     meta:
       server: 1
       workstation: 1
       CIS_ID:
       - 1.1.4.3
       CISv8: 3.3
       CISv8_IG1: true
       CISv8_IG2: true
       CISv8_IG3: true
  {{ end }}
  {{ if .Vars.rhel9cis_rule_1_1_4_4 }}
  nodev_var_tmp_fstab:
     title: 1.1.4.4 | Ensure nodev option set on /var/tmp partition | fstab config
     exec: grep '.*\/var\/tmp\s.*nodev.*$' \/etc\/fstab
     exit-status:
       or:
       - 0
       - 1
     stdout:
     - '/.*\/var\/tmp\s.*nodev.*$/'
     meta:
       server: 1
       workstation: 1
       CIS_ID:
       - 1.1.4.4
       CISv8: 3.3
       CISv8_IG1: true
       CISv8_IG2: true
       CISv8_IG3: true
  {{ end }}
  {{ end }}
{{ end }}