# Ensure hfsplus kernel module is not available

Necessity: The 'hfsplus' kernel module provides support for the Apple HFS+ filesystem. Disabling unused kernel modules is a critical security practice that reduces the system's attack surface. If this module is not required for system operation, disabling it prevents potential exploitation of any vulnerabilities within the module's code, thereby hardening the kernel against local privilege escalation or denial-of-service attacks. The risk of misconfiguration is that an unnecessary and potentially vulnerable piece of code remains active in the kernel. Auditing and Remediation: The audit script verifies if the system is configured to prevent the 'hfsplus' module from being loaded by checking the modprobe configuration files. The remediation script enforces this security measure by creating a rule that effectively overrides the module-loading mechanism for 'hfsplus', and ensures the module is not currently active in the running kernel. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Disabled'. This is based on the security principle of minimizing the attack surface. Since HFS+ is a specialized filesystem not typically used in enterprise Linux server environments, there is no common operational justification for it to be enabled. Any configuration other than 'Disabled' represents an unnecessary risk, making a consistent and strict recommendation appropriate for all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the 'hfsplus' kernel module is disabled. The script should query the modprobe configuration for the 'hfsplus' module. If the configuration is set to prevent loading (e.g., 'install /bin/true' or 'blacklist'), the script must output the string 'Disabled'. Otherwise, it should output 'Enabled'. The output must contain only one of these two strings, with no additional text.

## Remediation Script Working

bash script that accepts a single positional command-line argument to set the state of the 'hfsplus' kernel module. If the argument is 'Disabled', the script must create a configuration file in '/etc/modprobe.d/' containing 'install hfsplus /bin/true'. It should also unload the module using 'rmmod hfsplus' if it is currently loaded. The script must output 'true' on successful configuration and 'false' on failure.

