# Ensure jffs2 kernel module is not available

Necessity: The 'jffs2' (Journalling Flash File System 2) kernel module provides support for a filesystem designed for raw flash memory devices. On most servers and workstations, this type of filesystem is not in use, making the module unnecessary. Disabling unused kernel modules is a critical security best practice that reduces the system's attack surface. An unnecessary but loaded module exposes the kernel to potential vulnerabilities that could be exploited by a local attacker to achieve privilege escalation.

Auditing and Remediation: The audit script verifies that the system is configured to prevent the 'jffs2' module from being loaded, typically by checking for a specific instruction in the modprobe configuration directory ('/etc/modprobe.d/'). The remediation script automates the process of disabling the module by creating a configuration file that instructs the system to run '/bin/true' instead of loading the module, effectively deactivating it.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This is because the 'jffs2' filesystem is highly specialized. If the system does not explicitly require it for interacting with raw flash storage, the module should be disabled to adhere to the principle of least functionality. There is no intermediate or less secure state that offers any benefit; the module is either required for a specific hardware function or it is not. By disabling it, you eliminate a potential vector for kernel exploits without impacting standard system operations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the system's kernel module configuration for 'jffs2'. The script must check if the module is disabled via modprobe configuration (e.g., 'install jffs2 /bin/true'). The script should output only the string 'Disabled' if it is correctly disabled, or 'Enabled' if it is not.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state ('Enabled' or 'Disabled'). If the argument is 'Disabled', the script must create a file in '/etc/modprobe.d/' with the content 'install jffs2 /bin/true' to prevent the module from being loaded. If the argument is 'Enabled', it must remove that configuration file. The script must return 'true' upon successful application of the state, and 'false' on failure.

