# Ensure udf kernel module is not available

Necessity: The UDF (Universal Disk Format) filesystem is used for optical media such as DVDs. Disabling the kernel module for UDF reduces the system's attack surface. If the system does not have a legitimate need to read optical media, loading this module unnecessarily exposes the kernel to potential vulnerabilities that could be exploited through specially crafted filesystem images. This follows the security principle of minimizing system functionality to the bare essentials.

Auditing and Remediation: The audit script verifies that the system is configured to prevent the 'udf' module from loading and confirms that it is not currently active in the kernel. The remediation script implements this configuration by creating a modprobe rule to blacklist the module and attempts to unload it from the running kernel, effectively disabling it.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. For this type of binary control, the only secure state is to disable the module if it is not required. There is no middle ground. This recommendation is consistent with security hardening benchmarks (such as CIS) which advise disabling unnecessary filesystems to create a more secure and less complex kernel environment. For servers or workstations that do not use optical drives, this is a critical hardening step.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'udf' kernel module is disabled. The script must check the output of 'modprobe -n -v udf' for the 'install /bin/true' setting and confirm the module is not currently loaded by checking the output of 'lsmod | grep udf'. The script should output only the string 'Disabled' if both conditions are met, or 'Enabled' otherwise, with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be 'Disabled'. The script must create a configuration file in '/etc/modprobe.d/' to prevent the 'udf' kernel module from being loaded. It should also attempt to unload the module using 'rmmod' if it is currently active. The script must output the boolean value 'true' on successful application of the setting, and 'false' on failure.

