# Ensure usb-storage kernel module is not available

The `usb-storage` kernel module enables the system to recognize and mount USB mass storage devices. Disabling this module is a critical security measure to prevent data exfiltration and the introduction of malware from unauthorized physical media. Misconfiguration leaves a significant physical attack vector open, allowing anyone with access to the machine to potentially compromise the system or steal data. The audit script verifies the system's `modprobe` configuration to determine if loading the `usb-storage` module is prohibited. The remediation script implements this prohibition by creating a configuration file that instructs the kernel to execute a null command (`/bin/true`) instead of loading the actual module. The recommended state for all security levels (Basic, Moderate, and Strict) is 'Disabled' because there is no middle ground for this control; it should be disabled on any system that does not have an explicit operational requirement for USB storage, such as servers or secure workstations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check if the `usb-storage` kernel module is disabled. The script must query the `modprobe` configuration by running `modprobe -n -v usb-storage`. If the output is exactly 'install /bin/true', the script must return the string 'Disabled'. In all other cases, it must return 'Enabled'. The script should output only the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Disabled' or 'Enabled'. If the argument is 'Disabled', the script must create a configuration file (e.g., `/etc/modprobe.d/usb-storage.conf`) containing the line `install usb-storage /bin/true`. If the argument is 'Enabled', it must remove that specific line from the relevant configuration file. The script must unload the module (`rmmod usb-storage`) after applying the change if it is currently loaded. It must return `true` on success and `false` on failure.

