Blame SOURCES/scap-security-guide-0.1.41-untemplate_var_tmp.patch

28bffe
diff --git a/debian8/templates/csv/mount_options.csv b/debian8/templates/csv/mount_options.csv
28bffe
index 6e00a922cc..c85df506af 100644
28bffe
--- a/debian8/templates/csv/mount_options.csv
28bffe
+++ b/debian8/templates/csv/mount_options.csv
28bffe
@@ -19,4 +19,3 @@
28bffe
 /tmp,nodev
28bffe
 /tmp,nosuid
28bffe
 /usr,nodev
28bffe
-/var/tmp,bind
28bffe
diff --git a/fedora/templates/csv/mount_options.csv b/fedora/templates/csv/mount_options.csv
28bffe
index 6bbdea38f9..9f4361a7f4 100644
28bffe
--- a/fedora/templates/csv/mount_options.csv
28bffe
+++ b/fedora/templates/csv/mount_options.csv
28bffe
@@ -12,5 +12,4 @@
28bffe
 /tmp,nodev
28bffe
 /tmp,noexec
28bffe
 /tmp,nosuid
28bffe
-/var/tmp,bind
28bffe
 
28bffe
diff --git a/shared/fixes/bash/mount_option_var_tmp_bind.sh
28bffe
new file mode 100644
28bffe
index 0000000000..1466eff5f5
28bffe
--- /dev/null
28bffe
+++ b/shared/fixes/bash/mount_option_var_tmp_bind.sh
28bffe
@@ -0,0 +1,17 @@
28bffe
+# platform = multi_platform_rhel,multi_platform_fedora
28bffe
+
28bffe
+. /usr/share/scap-security-guide/remediation_functions
28bffe
+
28bffe
+# Delete particular /etc/fstab's row if /var/tmp is already configured to
28bffe
+# represent a mount point (for some device or filesystem other than /tmp)
28bffe
+if grep -q -P '.*\/var\/tmp.*' /etc/fstab
28bffe
+then
28bffe
+  sed -i '/.*\/var\/tmp.*/d' /etc/fstab
28bffe
+fi
28bffe
+umount /var/tmp
28bffe
+
28bffe
+# Bind-mount /var/tmp to /tmp via /etc/fstab (preserving the /etc/fstab form)
28bffe
+printf "%-24s%-24s%-8s%-32s%-3s\n" "/tmp" "/var/tmp" "none" "rw,nodev,noexec,nosuid,bind" "0 0" >> /etc/fstab
28bffe
+
28bffe
+mkdir -p /var/tmp
28bffe
+mount -B /tmp /var/tmp
28bffe
diff --git a/shared/checks/oval/mount_option_var_tmp_bind.xml
28bffe
new file mode 100644
28bffe
index 0000000000..7280364cfa
28bffe
--- /dev/null
28bffe
+++ b/shared/checks/oval/mount_option_var_tmp_bind.xml
28bffe
@@ -0,0 +1,85 @@
28bffe
+<def-group>
28bffe
+  <definition class="compliance" id="mount_option_var_tmp_bind" version="1">
28bffe
+    <metadata>
28bffe
+      <title>Bind Mount /var/tmp To /tmp</title>
28bffe
+      <affected family="unix">
28bffe
+        <platform>multi_platform_all</platform>
28bffe
+      </affected>
28bffe
+      <description>The /var/tmp directory should be bind mounted to /tmp in
28bffe
+      order to consolidate temporary storage into one location protected by the
28bffe
+      same techniques as /tmp.</description>
28bffe
+    </metadata>
28bffe
+    <criteria operator="AND">
28bffe
+      
28bffe
+      test_ref="test_configure_mount_option_var_tmp_bind_tmp" />
28bffe
+      
28bffe
+      test_ref="test_mount_option_var_tmp" />
28bffe
+      <criteria operator="OR">
28bffe
+        
28bffe
+        test_ref="test_mount_option_var_tmp_bind" />
28bffe
+        
28bffe
+        test_ref="test_mount_option_var_tmp_bind_compare_source" />
28bffe
+      </criteria>
28bffe
+    </criteria>
28bffe
+  </definition>
28bffe
+
28bffe
+  
28bffe
+  comment="Ensure /var/tmp is configured to bind mount to /tmp"
28bffe
+  id="test_configure_mount_option_var_tmp_bind_tmp" version="1">
28bffe
+    <ind:object object_ref="object_configure_mount_option_var_tmp_bind_tmp" />
28bffe
+  </ind:textfilecontent54_test>
28bffe
+  
28bffe
+  id="object_configure_mount_option_var_tmp_bind_tmp" version="1">
28bffe
+    <ind:filepath>/etc/fstab</ind:filepath>
28bffe
+    <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
28bffe
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
28bffe
+  </ind:textfilecontent54_object>
28bffe
+
28bffe
+  
28bffe
+  comment="Ensure /var/tmp is mounted" check="all">
28bffe
+    <linux:object object_ref="object_mount_option_var_tmp" />
28bffe
+  </linux:partition_test>
28bffe
+  <linux:partition_object id="object_mount_option_var_tmp" version="1">
28bffe
+    <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
28bffe
+  </linux:partition_object>
28bffe
+
28bffe
+  
28bffe
+       the bind mount option. As a result, the less elegant textfilecontent54_test
28bffe
+       is required here. -->
28bffe
+
28bffe
+  
28bffe
+  comment="Ensure bind mount option is on /var/tmp"
28bffe
+  id="test_mount_option_var_tmp_bind" version="1">
28bffe
+    <ind:object object_ref="object_mount_option_var_tmp_bind" />
28bffe
+  </ind:textfilecontent54_test>
28bffe
+  
28bffe
+  id="object_mount_option_var_tmp_bind" version="1">
28bffe
+    <ind:filepath>/etc/mtab</ind:filepath>
28bffe
+    <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
28bffe
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
28bffe
+  </ind:textfilecontent54_object>
28bffe
+
28bffe
+  
28bffe
+       about binded mounts anymore. An alternative is to check if
28bffe
+       /tmp and /var/tmp have the same source device -->
28bffe
+
28bffe
+  
28bffe
+  comment="Ensure /var/tmp and /tmp have the same source device" check="all">
28bffe
+    <linux:object object_ref="object_mount_option_var_tmp_bind_compare_source" />
28bffe
+    <linux:state state_ref="state_mount_option_var_tmp_bind_compare_source" />
28bffe
+  </linux:partition_test>
28bffe
+  <linux:partition_object id="object_mount_option_var_tmp_bind_compare_source" version="1">
28bffe
+    <linux:mount_point operation="pattern match">/tmp</linux:mount_point>
28bffe
+  </linux:partition_object>
28bffe
+  <linux:partition_state id="state_mount_option_var_tmp_bind_compare_source" version="1">
28bffe
+    
28bffe
+    operation="equals" var_ref="var_mount_option_var_tmp_bind_var_tmp_source_device"/>
28bffe
+  </linux:partition_state>
28bffe
+
28bffe
+  
28bffe
+  id="var_mount_option_var_tmp_bind_var_tmp_source_device" version="1">
28bffe
+    
28bffe
+    object_ref="object_mount_option_var_tmp" />
28bffe
+  </local_variable>
28bffe
+
28bffe
+</def-group>
28bffe
diff --git a/ol7/templates/csv/mount_options.csv b/ol7/templates/csv/mount_options.csv
28bffe
index 2f0aa49f0d..122198b57a 100644
28bffe
--- a/ol7/templates/csv/mount_options.csv
28bffe
+++ b/ol7/templates/csv/mount_options.csv
28bffe
@@ -1,3 +1,2 @@
28bffe
 /dev/shm,nodev
28bffe
 /dev/shm,nosuid
28bffe
-/var/tmp,bind
28bffe
diff --git a/opensuse/templates/csv/mount_options.csv b/opensuse/templates/csv/mount_options.csv
28bffe
deleted file mode 100644
28bffe
index e024d02571..0000000000
28bffe
--- a/opensuse/templates/csv/mount_options.csv
28bffe
+++ /dev/null
28bffe
@@ -1,9 +0,0 @@
28bffe
-# format:
28bffe
-# <mount_point>,<mount_option>[,create_fstab_entry_if_needed]
28bffe
-# - mount point mounted with specified option. for more than
28bffe
-#     one option, use multiple lines with the same <mount_point>, use the 
28bffe
-#     variable name (i.e. name beginning with var_, without the leading
28bffe
-#     '$' to reference a variable, e.g. var_removable_partition,nodev)
28bffe
-#  If the remediation can create (i.e. not just modify) an /etc/fstab line,
28bffe
-#  add the 'create_fstab_entry_if_needed' literal string as the third argument.
28bffe
-/var/tmp,bind
28bffe
diff --git a/rhel-osp7/templates/csv/mount_options.csv b/rhel-osp7/templates/csv/mount_options.csv
28bffe
deleted file mode 100644
28bffe
index e024d02571..0000000000
28bffe
--- a/rhel-osp7/templates/csv/mount_options.csv
28bffe
+++ /dev/null
28bffe
@@ -1,9 +0,0 @@
28bffe
-# format:
28bffe
-# <mount_point>,<mount_option>[,create_fstab_entry_if_needed]
28bffe
-# - mount point mounted with specified option. for more than
28bffe
-#     one option, use multiple lines with the same <mount_point>, use the 
28bffe
-#     variable name (i.e. name beginning with var_, without the leading
28bffe
-#     '$' to reference a variable, e.g. var_removable_partition,nodev)
28bffe
-#  If the remediation can create (i.e. not just modify) an /etc/fstab line,
28bffe
-#  add the 'create_fstab_entry_if_needed' literal string as the third argument.
28bffe
-/var/tmp,bind
28bffe
diff --git a/rhel6/templates/csv/mount_options.csv b/rhel6/templates/csv/mount_options.csv
28bffe
index ebf6bba9df..de0056e08c 100644
28bffe
--- a/rhel6/templates/csv/mount_options.csv
28bffe
+++ b/rhel6/templates/csv/mount_options.csv
28bffe
@@ -12,4 +12,3 @@
28bffe
 /tmp,nodev
28bffe
 /tmp,noexec
28bffe
 /tmp,nosuid
28bffe
-/var/tmp,bind
28bffe
diff --git a/rhel7/templates/csv/mount_options.csv b/rhel7/templates/csv/mount_options.csv
28bffe
index f5d9ed8cea..f9a3bc73dd 100644
28bffe
--- a/rhel7/templates/csv/mount_options.csv
28bffe
+++ b/rhel7/templates/csv/mount_options.csv
28bffe
@@ -19,4 +19,3 @@
28bffe
 /var/tmp,nodev
28bffe
 /var/tmp,noexec
28bffe
 /var/tmp,nosuid
28bffe
-/var/tmp,bind
28bffe
diff --git a/sle11/templates/csv/mount_options.csv b/sle11/templates/csv/mount_options.csv
28bffe
deleted file mode 100644
28bffe
index e024d02571..0000000000
28bffe
--- a/sle11/templates/csv/mount_options.csv
28bffe
+++ /dev/null
28bffe
@@ -1,9 +0,0 @@
28bffe
-# format:
28bffe
-# <mount_point>,<mount_option>[,create_fstab_entry_if_needed]
28bffe
-# - mount point mounted with specified option. for more than
28bffe
-#     one option, use multiple lines with the same <mount_point>, use the 
28bffe
-#     variable name (i.e. name beginning with var_, without the leading
28bffe
-#     '$' to reference a variable, e.g. var_removable_partition,nodev)
28bffe
-#  If the remediation can create (i.e. not just modify) an /etc/fstab line,
28bffe
-#  add the 'create_fstab_entry_if_needed' literal string as the third argument.
28bffe
-/var/tmp,bind
28bffe
diff --git a/sle12/templates/csv/mount_options.csv b/sle12/templates/csv/mount_options.csv
28bffe
index 759e51b0fe..b2df6c9f08 100644
28bffe
--- a/sle12/templates/csv/mount_options.csv
28bffe
+++ b/sle12/templates/csv/mount_options.csv
28bffe
@@ -17,4 +17,3 @@
28bffe
 /var/tmp,nodev
28bffe
 /var/tmp,noexec
28bffe
 /var/tmp,nosuid
28bffe
-/var/tmp,bind
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/partition.sh b/tests/data/group_system/group_permissions/group_partitions/partition.sh
28bffe
index 333a574f5e..f74a98b5b3 100644
28bffe
--- a/tests/data/group_system/group_permissions/group_partitions/partition.sh
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/partition.sh
28bffe
@@ -8,16 +8,21 @@ create_partition() {
28bffe
 }
28bffe
 
28bffe
 # $1: The mount point
28bffe
-# $2: The additional mount options
28bffe
+# $2: The type of file system
28bffe
+# $3: The additional mount options
28bffe
 make_fstab_given_partition_line() {
28bffe
-	local _mount_point="$1" _additional_mount_options="$2"
28bffe
+	local _mount_point="$1" _type="$2" _additional_mount_options="$3"
28bffe
 	test -z "$_additional_mount_options" || _additional_mount_options=",$_additional_mount_options"
28bffe
-	printf "%s     %s     ext2     rw%s     0 0\n" "$PARTITION" "$_mount_point" "$_additional_mount_options" > /etc/fstab
28bffe
+	printf "%s     %s     %s     rw%s     0 0\n" "$PARTITION" "$_mount_point" "$_type" "$_additional_mount_options" >> /etc/fstab
28bffe
 }
28bffe
 
28bffe
 # $1: The mount point
28bffe
 make_fstab_correct_partition_line() {
28bffe
-	make_fstab_given_partition_line "$1" "nodev,noexec,nosuid"
28bffe
+	make_fstab_given_partition_line "$1" "ext2" "nodev,noexec,nosuid"
28bffe
+}
28bffe
+
28bffe
+make_fstab_bind_partition_line() {
28bffe
+	make_fstab_given_partition_line "$1" "none" "nodev,noexec,nosuid,bind"
28bffe
 }
28bffe
 
28bffe
 # $1: The mount point
28bffe
@@ -28,5 +33,13 @@ mount_partition() {
28bffe
 
28bffe
 mount_bind_partition() {
28bffe
 	mkdir -p "$1"
28bffe
-	mount --target -B "$1"
28bffe
+	mount -B "$PARTITION" "$1"
28bffe
+}
28bffe
+
28bffe
+# $1: The path to umount and remove from /etc/fstab
28bffe
+clean_up_partition() {
28bffe
+    path="$1"
28bffe
+    escaped_path=${path//$'/'/$'\/'}
28bffe
+    sed -i "/${escaped_path}/d" /etc/fstab
28bffe
+    umount ${path} || true  # no problem if not mounted
28bffe
 }
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_home_nosuid/fstab.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_home_nosuid/fstab.fail.sh
28bffe
index 498f44911f..0cc19818d9 100644
28bffe
--- a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_home_nosuid/fstab.fail.sh
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_home_nosuid/fstab.fail.sh
28bffe
@@ -7,6 +7,6 @@ umount /home || true  # no problem if not mounted
28bffe
 
28bffe
 create_partition
28bffe
 
28bffe
-make_fstab_given_partition_line /home nodev
28bffe
+make_fstab_given_partition_line /home ext2 nodev
28bffe
 
28bffe
 mount_partition /home
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_tmp_noexec/fstab.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_tmp_noexec/fstab.fail.sh
28bffe
index 3128ad2aee..62d36b718a 100644
28bffe
--- a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_tmp_noexec/fstab.fail.sh
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_tmp_noexec/fstab.fail.sh
28bffe
@@ -5,6 +5,6 @@
28bffe
 
28bffe
 create_partition
28bffe
 
28bffe
-make_fstab_given_partition_line /tmp nodev
28bffe
+make_fstab_given_partition_line /tmp ext2 nodev
28bffe
 
28bffe
 mount_partition /tmp
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/configured_and_mounted.pass.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/configured_and_mounted.pass.sh
28bffe
new file mode 100644
28bffe
index 0000000000..ad3c5d4f50
28bffe
--- /dev/null
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/configured_and_mounted.pass.sh
28bffe
@@ -0,0 +1,13 @@
28bffe
+#!/bin/bash
28bffe
+# profiles = xccdf_org.ssgproject.content_profile_C2S
28bffe
+
28bffe
+. ../partition.sh
28bffe
+
28bffe
+# Make sure scenario preparation starts from a clean state
28bffe
+clean_up_partition /var/tmp
28bffe
+
28bffe
+# Redefine PARTITION variable defined in partition.sh
28bffe
+PARTITION="/tmp"
28bffe
+make_fstab_bind_partition_line /var/tmp
28bffe
+
28bffe
+mount_bind_partition /var/tmp
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/just_configured.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/just_configured.fail.sh
28bffe
new file mode 100644
28bffe
index 0000000000..87e7fc9726
28bffe
--- /dev/null
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/just_configured.fail.sh
28bffe
@@ -0,0 +1,11 @@
28bffe
+#!/bin/bash
28bffe
+# profiles = xccdf_org.ssgproject.content_profile_C2S
28bffe
+
28bffe
+. ../partition.sh
28bffe
+
28bffe
+# Make sure scenario preparation starts from a clean state
28bffe
+clean_up_partition /var/tmp
28bffe
+
28bffe
+# Redefine PARTITION variable defined in partition.sh
28bffe
+PARTITION="/tmp"
28bffe
+make_fstab_bind_partition_line /var/tmp
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/just_mounted.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/just_mounted.fail.sh
28bffe
new file mode 100644
28bffe
index 0000000000..d1bcb5a220
28bffe
--- /dev/null
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/just_mounted.fail.sh
28bffe
@@ -0,0 +1,10 @@
28bffe
+#!/bin/bash
28bffe
+# profiles = xccdf_org.ssgproject.content_profile_C2S
28bffe
+
28bffe
+. ../partition.sh
28bffe
+
28bffe
+# Make sure scenario preparation starts from a clean state
28bffe
+clean_up_partition /var/tmp
28bffe
+
28bffe
+# just mount the partition
28bffe
+mount -B /tmp /var/tmp
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/separated_and_mounted.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/separated_and_mounted.fail.sh
28bffe
new file mode 100644
28bffe
index 0000000000..e315c54293
28bffe
--- /dev/null
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/separated_and_mounted.fail.sh
28bffe
@@ -0,0 +1,14 @@
28bffe
+#!/bin/bash
28bffe
+# profiles = xccdf_org.ssgproject.content_profile_C2S
28bffe
+
28bffe
+. ../partition.sh
28bffe
+
28bffe
+# Make sure scenario preparation starts from a clean state
28bffe
+clean_up_partition /var/tmp
28bffe
+
28bffe
+# by default /tmp is already configured and mounted
28bffe
+
28bffe
+# Redefine PARTITION
28bffe
+mkdir -p "$PARTITION"
28bffe
+make_fstab_bind_partition_line /var/tmp
28bffe
+mount_bind_partition /var/tmp
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/wrong_bind.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/wrong_bind.fail.sh
28bffe
new file mode 100644
28bffe
index 0000000000..6ec7d6cdea
28bffe
--- /dev/null
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_bind/wrong_bind.fail.sh
28bffe
@@ -0,0 +1,13 @@
28bffe
+#!/bin/bash
28bffe
+# profiles = xccdf_org.ssgproject.content_profile_C2S
28bffe
+
28bffe
+. ../partition.sh
28bffe
+
28bffe
+# Make sure scenario preparation starts from a clean state
28bffe
+clean_up_partition /var/tmp
28bffe
+
28bffe
+# PARTITION is defined in partition.sh
28bffe
+mkdir -p "$PARTITION"
28bffe
+make_fstab_bind_partition_line /var/tmp
28bffe
+
28bffe
+mount_bind_partition /var/tmp
28bffe
diff --git a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_noexec/fstab.fail.sh b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_noexec/fstab.fail.sh
28bffe
index 37bc6e9881..431636bd13 100644
28bffe
--- a/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_noexec/fstab.fail.sh
28bffe
+++ b/tests/data/group_system/group_permissions/group_partitions/rule_mount_option_var_tmp_noexec/fstab.fail.sh
28bffe
@@ -5,6 +5,6 @@
28bffe
 
28bffe
 create_partition
28bffe
 
28bffe
-make_fstab_given_partition_line /var/tmp nodev
28bffe
+make_fstab_given_partition_line /var/tmp ext2 nodev
28bffe
 
28bffe
 mount_partition /var/tmp
28bffe
diff --git a/ubuntu1404/templates/csv/mount_options.csv b/ubuntu1404/templates/csv/mount_options.csv
28bffe
index 6e00a922cc..c85df506af 100644
28bffe
--- a/ubuntu1404/templates/csv/mount_options.csv
28bffe
+++ b/ubuntu1404/templates/csv/mount_options.csv
28bffe
@@ -19,4 +19,3 @@
28bffe
 /tmp,nodev
28bffe
 /tmp,nosuid
28bffe
 /usr,nodev
28bffe
-/var/tmp,bind
28bffe
diff --git a/ubuntu1604/templates/csv/mount_options.csv b/ubuntu1604/templates/csv/mount_options.csv
28bffe
index 6e00a922cc..c85df506af 100644
28bffe
--- a/ubuntu1604/templates/csv/mount_options.csv
28bffe
+++ b/ubuntu1604/templates/csv/mount_options.csv
28bffe
@@ -19,4 +19,3 @@
28bffe
 /tmp,nodev
28bffe
 /tmp,nosuid
28bffe
 /usr,nodev
28bffe
-/var/tmp,bind
28bffe
diff --git a/wrlinux/templates/csv/mount_options.csv b/wrlinux/templates/csv/mount_options.csv
28bffe
index 6bbdea38f9..9f4361a7f4 100644
28bffe
--- a/wrlinux/templates/csv/mount_options.csv
28bffe
+++ b/wrlinux/templates/csv/mount_options.csv
28bffe
@@ -12,5 +12,4 @@
28bffe
 /tmp,nodev
28bffe
 /tmp,noexec
28bffe
 /tmp,nosuid
28bffe
-/var/tmp,bind
28bffe