noexecを使用した/dev/shmマウント

RHEL/CentOS 7.9では、デフォルトでtmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,seclabel)

セキュリティルールによれば、セキュリティオプションnosuid、nodev、およびnosuidを使用してインストールする必要があります。実行されない。

noexecRHELがすでに他の2つを使用していますが、それを自動的に含めないのはなぜですか？

このオプション（説明を含む）を排他的に使用するのはnoexec良い考えですか、悪い考えですか/dev/shm？これが良い考えであれば、対応するマウントステートメントが存在しないので、それを実装する方法/etc/fstab

参照: U_RHEL_7_V3R6_STIG_SCAP_1-2_Benchmark.zip

インターネット上の誰でもダウンロードできます。https://public.cyber.mil/stigs/downloads/Operating Systems/redhat7 で以下をお読みください。

Rule Title: The Red Hat Enterprise Linux operating system must
            mount /dev/shm with secure options.

Discussion: The "noexec" mount option causes the system to not execute
            binary files. This option must be used for mounting any file
            system not containing approved binary files as they may be
            incompatible. Executing files from untrusted file systems 
            increases the opportunity for unprivileged users to attain 
            unauthorized administrative access.

The "nodev" mount option causes the system to not interpret character or
block special devices. Executing character or block special devices from 
untrusted file systems increases the opportunity for unprivileged users 
to attain unauthorized administrative access.

The "nosuid" mount option causes the system to not execute "setuid" and 
"setgid" files with owner privileges. This option must be used for 
mounting any file system not containing approved "setuid" and "setguid" 
files. Executing files from untrusted file systems increases the 
opportunity for unprivileged users to attain unauthorized administrative 
access.

Check Text: Verify that the "nodev","nosuid", and "noexec" options are
            configured for /dev/shm:

cat /etc/fstab | grep /dev/shm

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

If results are returned and the "nodev", "nosuid", or "noexec" options
are missing, this is a finding.

Verify "/dev/shm" is mounted with the "nodev", "nosuid", and "noexec" 
options:  mount | grep /dev/shm

tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel)

If /dev/shm is mounted without secure options "nodev", "nosuid", and 
"noexec", this is a finding.

Fix Text: Configure the system so that /dev/shm is mounted with the
          "nodev", "nosuid", and "noexec" options by adding /modifying 
          the /etc/fstab with the following line:

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0