# Ensure hfs kernel module is not available

Necessity: The 'hfs' kernel module provides support for the Hierarchical File System, a legacy filesystem used by older Apple systems. On systems that do not need to mount HFS filesystems, this module is unnecessary. Disabling unused kernel modules reduces the system's attack surface. A flaw in an unused but loadable kernel module could potentially be exploited by a local attacker to escalate privileges or cause a denial-of-service condition. Following the principle of least functionality, any component not required for the system's operation should be disabled to enhance security. Auditing and Remediation: The audit script verifies if there is an active configuration in '/etc/modprobe.d/' that prevents the 'hfs' module from being loaded. The remediation script creates such a configuration file, which typically contains 'install hfs /bin/true' and 'blacklist hfs', to effectively disable the module. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'disabled'. There is no security benefit to leaving this legacy filesystem module enabled on a modern server or workstation unless there is a specific operational requirement. Disabling it is a standard hardening practice recommended by security benchmarks like CIS. Since the module's state is binary (either available or not), there are no intermediate levels of security; complete disabling is the only recommended action.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the status of the 'hfs' kernel module. The script should determine if the module is disabled (blacklisted and/or has its install command overridden). It must output 'disabled' if a configuration exists to prevent it from loading (e.g., 'install hfs /bin/true'). Otherwise, it should output 'enabled'. The script must return only the status string without any additional text.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired state ('enabled' or 'disabled'). If the argument is 'disabled', the script must create a configuration file in '/etc/modprobe.d/' to prevent the 'hfs' module from being loaded and unload it if currently active. If the argument is 'enabled', it must remove this configuration. The script must return the string 'true' on success and 'false' on failure.

