1.1.2.5.4.sh

#!/usr/bin/env bash

# CIS 1.1.2.5.4 Ensure noexec option set on /var/tmp partition

TARGET="/var/tmp"
STATUS=""
REASON=""

# Step 1: Check if module exists on disk
if [ ! -d "$TARGET" ]; then
    STATUS=Failed
    REASON="/var/tmp does not exist"
    echo "$STATUS | $REASON"
    exit 1
fi

# Step 2: Check if module is loaded
if ! findmnt -kn "$TARGET" >/dev/null 2>&1; then
    STATUS=Failed
    REASON="/var/tmp is not mounted"
    echo "$STATUS | $REASON"
    exit 1
fi

# Step 3: Check configuration
if findmnt -kn /var/tmp -o OPTIONS | grep -vq noexec; then
    STATUS=Failed
    REASON="noexec option is not set on /var/tmp"
    echo "$STATUS | $REASON"
    exit 1
fi

# Final pass
STATUS=Passed
echo "$STATUS |"
exit 0