# Ensure unused filesystems kernel modules are not available

Necessity: The Linux kernel has a modular design, allowing drivers and features, such as filesystem support, to be loaded and unloaded as needed. Each loaded kernel module increases the kernel's attack surface. If a vulnerability exists in a filesystem driver that is not in use (e.g., hfs, squashfs, udf), an attacker could potentially craft a malicious filesystem image and trick the system into mounting it, thereby exploiting the vulnerability to escalate privileges or cause a denial of service. Disabling unused modules is a critical hardening step that follows the principle of least functionality, minimizing the available vectors for kernel-level attacks.

Auditing and Remediation: The audit script verifies two conditions: first, that there is a persistent configuration in `/etc/modprobe.d/` to prevent the specified modules from being loaded on boot or on-demand; second, that the modules are not currently active in memory. The remediation script enforces this state by creating the necessary `modprobe` configuration file to block future loading and uses the `rmmod` command to unload any currently active modules, effectively removing the potential threat from the running system.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, Strict) is 'Disabled'. For this particular control, there is no gradation of security. A module is either a necessary component of the system's operation or it is an unnecessary risk. If these filesystems are not required, they should be disabled to reduce the kernel attack surface. Therefore, the baseline security posture is the same as the most stringent one: completely disable the modules.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that iterates through a list of unused filesystem kernel modules (cramfs, freevxfs, jffs2, hfs, hfsplus, squashfs, udf). For each module, it must check if it is disabled via a configuration file in /etc/modprobe.d/ (e.g., contains 'install <module_name> /bin/true') AND if it is not currently loaded (verified via `lsmod`). The script must return a comma-separated list of any modules that are not properly disabled. If all specified modules are disabled, it must return the string 'Disabled'. The output must contain only this value.

## Remediation Script Working

Bash script that accepts a single string argument, which must be 'Disabled'. If the argument is 'Disabled', the script must create a configuration file in `/etc/modprobe.d/` to prevent the loading of the `cramfs`, `freevxfs`, `jffs2`, `hfs`, `hfsplus`, `squashfs`, and `udf` kernel modules by adding the line 'install <module_name> /bin/true' for each. The script must also attempt to unload these modules using `rmmod` if they are currently loaded. The script must return `true` on successful configuration and `false` on any failure.

