# Ensure cramfs kernel module is not available

Necessity: The 'cramfs' (Compressed ROM File System) is a legacy filesystem that is rarely used on modern systems. Disabling unused kernel modules reduces the system's attack surface. If an attacker finds a vulnerability in the cramfs driver, they could potentially exploit it to escalate privileges, especially if they can trick the system into loading and mounting a malicious cramfs image. By making the module unavailable, this entire class of potential vulnerabilities is mitigated.

Auditing and Remediation: The audit script verifies the system's configuration by checking two conditions: whether the 'cramfs' module is currently loaded into the kernel (using 'lsmod') and whether a 'modprobe' configuration exists to prevent it from loading. The remediation script ensures the module is unavailable by creating a configuration file in '/etc/modprobe.d/' that effectively blacklists the module. It also removes the module from the running kernel ('rmmod') to apply the setting immediately without a reboot.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'disabled'. For this particular control, there is no graduation of security; the module is either available to be loaded or it is not. Since the filesystem is legacy and unnecessary for most systems, disabling it is the universal best practice. Any state other than 'disabled' ('loaded' or 'available') leaves an unnecessary potential attack vector open. Therefore, all security hardening levels mandate its removal to minimize kernel attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'cramfs' kernel module. The script must output 'disabled' if the module is prevented from loading via a modprobe configuration file. It must output 'loaded' if the module is currently active in the kernel. Otherwise, it must output 'available'. The output should be only the status string.

## Remediation Script Working

Bash script that accepts one positional argument which must be 'disabled'. If the argument is 'disabled', the script must create a configuration file at '/etc/modprobe.d/cramfs.conf' with the content 'install cramfs /bin/true' to prevent the module from being loaded. It should also unload the module from the running kernel if it is currently loaded. The script must return 'true' on success and 'false' on failure.

