# Ensure squashfs kernel module is not available

Necessity: The 'squashfs' filesystem is a compressed read-only filesystem commonly used for live CDs and snap packages. Disabling kernel modules that are not required for system functionality is a critical security hardening practice. It reduces the overall attack surface of the kernel, minimizing the risk of an attacker exploiting a potential vulnerability in the module's code to escalate privileges. If the system does not use snap packages or mount squashfs filesystems, this module should be disabled.

Auditing and Remediation: The audit script verifies the system's configuration by checking the '/etc/modprobe.d/' directory for rules that prevent the 'squashfs' module from being loaded, and it confirms the module is not currently active in the kernel's memory. The remediation script automates the process of disabling the module by creating the necessary 'modprobe.d' configuration file and unloading the module if it is active.

Recommended State Rationale: Basic, Moderate, and Strict states all recommend 'Disabled'. This is a binary security control; the module is either available or it is not. The secure state is to have it disabled to reduce the kernel's attack surface. There is no intermediate or less-strict configuration that still achieves the security goal. Any system not explicitly requiring 'squashfs' for its core operations should have it disabled to adhere to the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'squashfs' kernel module is disabled. The script should output 'Disabled' if a modprobe configuration is set to prevent it from loading, and the module is not currently loaded. Otherwise, it should output 'Enabled'. The script's output must only be the current value, with no other text.

## Remediation Script Working

Bash script that accepts a single command-line argument: 'Enabled' or 'Disabled'. If the argument is 'Disabled', the script must create a configuration file in '/etc/modprobe.d/' to prevent the 'squashfs' module from loading and unload it if currently running. If the argument is 'Enabled', it should remove the configuration. The script must return 'true' on success and 'false' on failure.

