20 lines
877 B
YAML
20 lines
877 B
YAML
# §37.4 — Filesystem mount hardening.
|
|
#
|
|
# Applying nodev/nosuid/noexec to /tmp, /home, /var/tmp requires
|
|
# editing /etc/fstab + reboot. Ansible can do the fstab edit but
|
|
# the reboot is operator-coordinated. This task documents what
|
|
# should be applied and emits a notice; it does NOT auto-reboot.
|
|
---
|
|
- name: Recommend mount hardening (manual fstab review required)
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
§37.4 mount hardening requires manual /etc/fstab review +
|
|
reboot. Recommended additions per OPERATIONS.md §37.4:
|
|
|
|
/tmp tmpfs defaults,nodev,nosuid,noexec 0 0
|
|
/var/tmp tmpfs defaults,nodev,nosuid,noexec 0 0
|
|
# /home — add nodev,nosuid only (need exec for user scripts)
|
|
|
|
Apply, then reboot when convenient. This playbook does NOT
|
|
modify fstab automatically because errors there can prevent
|
|
boot.
|