Details
The nodev mount option specifies that the filesystem cannot contain special devices.
Rationale:
Since the /tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices in /tmp.
Solution
If using the /etc/fstab for configuring /tmp do the following:
Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the /tmp partition. See the fstab(5) manual page for more information.
Run the following command to remount /tmp:
# mount -o remount,nodev /tmp
If using systemd tmp.mount for configuring /tmp do the following:
Edit /etc/systemd/system/local-fs.target.wants/tmp.mount and add the nodev option to the Options line
Example:
[Mount]
What=tmpfs
Where=/tmp
Type=tmpfs
Options=mode=1777,strictatime,noexec,nodev,nosuid
Run the following command to remount /tmp:
# mount -o remount,nosuid /tmp
Additional Information:
If the /etc/fstab includes /tmp it will take precedence over the tmp.mount file
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.