# Ensure jffs2 kernel module is not available

Necessity: The 'jffs2' (Journalling Flash File System v2) kernel module provides support for a filesystem designed for flash memory devices. If the system does not use this specific type of filesystem, loading the module unnecessarily increases the attack surface of the kernel. A vulnerability within this module could potentially be exploited for local privilege escalation or to cause a system denial-of-service. Disabling unused kernel modules is a fundamental security hardening principle.

Auditing and Remediation: The audit script checks the system's modprobe configuration to see if loading of the 'jffs2' module is explicitly forbidden and verifies it is not currently active in memory. The remediation script automates the process of disabling it by creating a modprobe configuration file and unloading the module if it's running.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Disabled'. This is a binary control; the module is either required for system functionality or it is not. If the filesystem is not in use, the module should be disabled to reduce risk, regardless of the desired security posture. There is no intermediate 'moderate' state for this setting.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'jffs2' kernel module is disabled. The script should verify that 'modprobe -n -v jffs2' indicates the module is set to be ignored (e.g., 'install /bin/true') and also confirm that the module is not currently loaded via 'lsmod'. It must return 'Disabled' if the module is unavailable and not loaded, and 'Enabled' otherwise. The output must only be the status string.

## Remediation Script Working

Bash script that accepts a single argument, which will be the desired state ('Disabled'). If the argument is 'Disabled', the script must create a configuration file in '/etc/modprobe.d/' to prevent the 'jffs2' module from being loaded (e.g., by adding 'install jffs2 /bin/true'). The script must also attempt to unload the 'jffs2' module if it is currently active. It must return 'true' on success and 'false' on failure.

