# Ensure rds kernel module is not available

The Reliable Datagram Sockets (RDS) protocol is designed for high-performance, low-latency communication over InfiniBand networks. If the system is not part of a high-performance computing (HPC) cluster or does not utilize InfiniBand hardware, the 'rds' kernel module is unnecessary. Disabling unused kernel modules is a critical security best practice that reduces the kernel's attack surface. A vulnerability in an unnecessary but loaded module could potentially be exploited to gain elevated privileges or cause a denial of service. The audit script verifies that the 'rds' module is properly disabled, either by checking that it is not loaded or that a modprobe configuration prevents it from loading. The remediation script enforces this state by creating a configuration file to blacklist the module and removing it from the running kernel. For this specific control, the recommended state is consistently 'disabled' across Basic, Moderate, and Strict profiles. There is no security benefit to keeping an unused module available; therefore, disabling it is the only recommended action to adhere to the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'rds' kernel module is disabled. The script must check if the module is either not loaded or explicitly blacklisted/disabled via modprobe configuration. The script should output only one of two strings: 'disabled' if the module is not available for loading, or 'enabled' if it is.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'disabled'. The script will create a configuration file in '/etc/modprobe.d/' containing 'install rds /bin/true' to prevent the module from being loaded. It must also unload the 'rds' module from the running kernel if it is currently loaded. The script must return the string 'true' on success and 'false' on failure.

