# Ensure unused filesystems kernel modules are not available

Necessity: Disabling unused filesystem kernel modules reduces the system's attack surface. Each loaded kernel module presents a potential vector for privilege escalation if a vulnerability is discovered within it. Filesystems like 'cramfs', 'hfs', and 'udf' are typically not used on enterprise Linux servers. By preventing them from being loaded, the system adheres to the principle of least functionality, minimizing the risk of a kernel-level compromise.

Auditing and Remediation: The audit script verifies that the specified filesystem modules are both prevented from being loaded via modprobe configuration and are not currently active in the running kernel. The remediation script enforces this state by creating a modprobe configuration file to block future loading of these modules and attempts to unload them from the current session.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is 'Disabled'. This is a binary control; the modules are either needed or they are not. If the system does not explicitly require these filesystems for its operation, they should be disabled to enhance security. There is no intermediate 'moderate' configuration. Enabling any of them reintroduces the associated risk, so all hardening levels recommend the most secure posture, which is to disable them entirely, in line with CIS Benchmark recommendations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the kernel modules 'cramfs', 'freevxfs', 'jffs2', 'hfs', 'hfsplus', 'squashfs', and 'udf' are disabled. The script must verify that a configuration file exists in '/etc/modprobe.d/' containing 'install <module_name> /bin/true' for each module and that none of these modules are currently loaded (by checking the output of 'lsmod'). The script must output a single string: 'Disabled' if all conditions are met for all modules, or 'Enabled' if any module is not properly disabled or is currently loaded. The output should contain no other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state. If the argument is 'Disabled', the script must create a configuration file (e.g., '/etc/modprobe.d/unused_filesystems.conf') with the content 'install <module_name> /bin/true' for each of the modules: 'cramfs', 'freevxfs', 'jffs2', 'hfs', 'hfsplus', 'squashfs', and 'udf'. It should also attempt to unload any of these modules if they are currently loaded using 'rmmod'. The script must output 'true' on successful application of the configuration or 'false' if it fails.

