# Ensure freevxfs kernel module is not available

Necessity: The 'freevxfs' kernel module provides support for the Veritas File System (VxFS). Disabling kernel modules for filesystems that are not in use is a critical security practice. It reduces the kernel's attack surface, mitigating the risk of a vulnerability in the filesystem driver being exploited. An attacker could potentially introduce a maliciously crafted VxFS filesystem to trigger a kernel-level flaw. By disabling the module, the system is prevented from loading the driver, thus closing this potential attack vector.

Auditing and Remediation: The audit script verifies if the system is configured to prevent the 'freevxfs' module from being loaded by checking the modprobe configuration files. The remediation script enforces this security measure by creating a configuration file (e.g., '/etc/modprobe.d/freevxfs.conf') that contains 'install freevxfs /bin/true'. This command overrides the default module loading behavior, ensuring it cannot be loaded either automatically or manually.

Recommended State Rationale: For this control, the recommended state is consistently 'disabled' across all security levels (Basic, Moderate, and Strict). This is because the control is binary; the module is either available or it is not. Basic security hardening, in line with CIS Benchmarks, requires disabling unused modules to adhere to the principle of least functionality. There is no intermediate 'moderately disabled' state. The most secure configuration (Strict) is to ensure the module is disabled, and this is the same recommendation for the Basic and Moderate levels as it fully mitigates the associated risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'freevxfs' kernel module. The script must query the system's module configuration. If the module is configured to be prevented from loading (e.g., via 'install freevxfs /bin/true' or 'blacklist freevxfs' in a modprobe configuration file), the script must return the string 'disabled'. Otherwise, it must return 'enabled'. The output must contain only the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state (e.g., 'disabled'). The script must create a configuration file in '/etc/modprobe.d/' to set the 'freevxfs' module's install command to '/bin/true', effectively preventing it from being loaded. The script must return 'true' upon successful creation of the configuration file and 'false' on any failure.

