# Ensure hfs kernel module is not available

The 'hfs' kernel module provides support for the Hierarchical File System, which is native to classic Mac OS. Disabling unused filesystem kernel modules is a crucial security best practice that reduces the system's attack surface. A vulnerability within the hfs driver could potentially be exploited by a local or remote attacker by tricking the system into mounting a malicious disk image, possibly leading to kernel panics, denial of service, or privilege escalation. The audit script verifies that a modprobe configuration is in place to prevent the hfs module from being loaded and confirms it is not active in the current kernel session. The remediation script implements this control by creating the necessary configuration file and unloading the module. For this control, the recommended state across all security levels (Basic, Moderate, Strict) is 'disabled', as there is no valid reason to have this legacy filesystem driver available on a modern enterprise Linux server. The only secure configuration is to ensure it cannot be loaded.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'hfs' kernel module is disabled. The script should inspect the system's modprobe configuration files for the line 'install hfs /bin/true' and also check if the module is currently loaded via 'lsmod'. If the module is configured to be disabled and is not currently loaded, the script must output the string 'disabled'. In all other cases, it must output 'enabled'. The script's output must consist solely of the resulting string.

## Remediation Script Working

Bash script that accepts a single positional argument, which should be the desired state ('disabled'). If the argument is 'disabled', the script must create a configuration file (e.g., '/etc/modprobe.d/hfs.conf') containing 'install hfs /bin/true' to prevent the module from being loaded. It should also unload the module from the running kernel using 'rmmod hfs' if it is currently active. The script must output 'true' on successful configuration and 'false' on failure.

