morphit/ops/ansible/roles/hardening/tasks/mounts.yml

20 lines
877 B
YAML

# §37.4 — Filesystem mount hardening.
#
# Applying nodev/nosuid/noexec to /tmp, /home, /var/tmp requires
# editing /etc/fstab + reboot. Ansible can do the fstab edit but
# the reboot is operator-coordinated. This task documents what
# should be applied and emits a notice; it does NOT auto-reboot.
---
- name: Recommend mount hardening (manual fstab review required)
ansible.builtin.debug:
msg: |
§37.4 mount hardening requires manual /etc/fstab review +
reboot. Recommended additions per OPERATIONS.md §37.4:
/tmp tmpfs defaults,nodev,nosuid,noexec 0 0
/var/tmp tmpfs defaults,nodev,nosuid,noexec 0 0
# /home — add nodev,nosuid only (need exec for user scripts)
Apply, then reboot when convenient. This playbook does NOT
modify fstab automatically because errors there can prevent
boot.