# Ensure freevxfs kernel module is not available

Necessity: The 'freevxfs' kernel module provides support for the Veritas File System (VxFS). If the system does not use this filesystem, loading the module is unnecessary and increases the kernel's attack surface. A vulnerability in this driver could potentially be exploited to compromise the system. Disabling unused kernel modules aligns with the security principle of least functionality, minimizing potential vectors for privilege escalation.

Auditing and Remediation: The audit script checks the system's module loading configuration to determine if 'freevxfs' has been explicitly prevented from loading. The remediation script implements this control by creating a modprobe configuration file that effectively blacklists the module, instructing the kernel to run '/bin/true' (which does nothing and succeeds) instead of loading the actual module.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'disabled'. This is a binary control; the module is either available for loading or it is not. Since VxFS is a legacy and uncommon filesystem for modern Linux distributions, its driver should be disabled on any system that does not explicitly require it. There is no security benefit to having it enabled if not in use, and thus no variation between security levels is necessary.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'freevxfs' kernel module is configured to be disabled. The script must query the modprobe configuration for 'freevxfs'. If the output indicates the module's installation command is '/bin/true', the script must return the string 'disabled'. Otherwise, it must return 'enabled'. The output must not contain any other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired state ('disabled'). If the argument is 'disabled', the script must create a configuration file in '/etc/modprobe.d/' to set 'install freevxfs /bin/true'. It must also unload the 'freevxfs' module from the running kernel if it is currently loaded. The script must return 'true' on success and 'false' on failure.

