# Ensure cramfs kernel module is not available

Necessity: The Compressed ROM File System (cramfs) is a legacy, read-only filesystem that is rarely used in modern systems. Keeping this kernel module available increases the system's attack surface. A vulnerability in the module's driver could potentially be exploited by an attacker to gain elevated privileges. Disabling unused kernel modules is a fundamental security principle to minimize risk.

Auditing and Remediation: The audit script verifies that the system is configured to prevent the 'cramfs' module from being loaded, typically by checking for a configuration file in '/etc/modprobe.d/'. The remediation script creates this configuration file to explicitly blacklist the module and also attempts to unload it from the running kernel.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. There is no intermediate state for this setting; the module is either available or it is not. Since 'cramfs' has no common use in modern CentOS environments, disabling it is the universal best practice across all security hardening levels to reduce the kernel's attack surface without impacting system functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the 'cramfs' kernel module is disabled. The script should query the system's modprobe configuration for 'cramfs' and also check if the module is currently loaded. If the modprobe configuration is set to prevent loading (e.g., 'install /bin/true') and the module is not currently loaded, the script must return the string 'Disabled'. Otherwise, it should return 'Enabled'. The output must only be the string value, with no extra text.

## Remediation Script Working

bash script that accepts one positional argument: the desired state ('Disabled'). If the argument is 'Disabled', the script must create a modprobe configuration file (e.g., '/etc/modprobe.d/cramfs.conf') to prevent the 'cramfs' module from being loaded. It should then attempt to unload the module from the running kernel if it is currently active. The script must return `true` on success and `false` on failure.

