# Ensure udf kernel module is not available

The Universal Disk Format (UDF) is a filesystem specification for optical media like DVDs. Disabling kernel modules that are not required follows the security principle of least functionality, which reduces the system's attack surface. If the system does not use optical media drives, the 'udf' module is unnecessary. A vulnerability within this module could potentially be exploited by an attacker who gains the ability to mount a crafted filesystem. The audit script verifies that system configuration explicitly prevents the 'udf' module from being loaded. The remediation script implements this configuration by creating a modprobe rule to disable it. All recommended states (Basic, Moderate, and Strict) are set to 'disabled' because there is no security justification for keeping an unnecessary kernel module available for loading, making its disablement a universal best practice for hardened systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'udf' kernel module is disabled. The script should query the modprobe configuration for 'udf'. If the output indicates the module is set to be installed with '/bin/true' (disabled), the script must return the string 'disabled'. Otherwise, it must return 'enabled'. The script must not return any other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired state ('disabled'). If the argument is 'disabled', the script must create a configuration file in '/etc/modprobe.d/' to prevent the 'udf' module from being loaded by adding the lines 'install udf /bin/true' and 'blacklist udf'. It should also unload the module from the running kernel if it is currently loaded. The script must return 'true' on success and 'false' on failure.

