fix for jammy cis 1.1.7.3

[xtreme-nitin-ravindran]

cis wants nosuid on /home mount

1.1.7.3 Ensure nosuid option set on /home partition

[rkoster]

@xtreme-nitin-ravindran could you provide a link to the relevant CIS documentation?

[xtreme-nitin-ravindran]

1.1.7.3 Ensure nosuid option set on /home partition (Automated)

Profile Applicability:

• Level 1 - Server
• Level 1 - Workstation

Description:

The nosuid mount option specifies that the filesystem cannot contain setuid files.
Rationale:
Since the /home filesystem is only intended for user file storage, set this option to ensure that users cannot create setuid files in /home.

Audit:

Verify that the nosuid option is set for the /home mount. Run the following command to verify that the nosuid mount option is set. Example:

# findmnt --kernel /home 
/home /dev/sdb ext4 rw,nosuid,nodev,relatime,seclabel

IF output is produced, ensure it includes the nosuid option

Remediation:

IF the /home partition exists, edit the /etc/fstab file and add nosuid to the fourth field (mounting options) for the /home partition. Example:

<device> /home <fstype> defaults,rw,nosuid,nodev,relatime 0 0

Run the following command to remount /home with the configured options:

# mount -o remount /home

https://www.cisecurity.org/benchmark/ubuntu_linux