# Ensure tipc kernel module is not available

Necessity: The Transparent Inter-Process Communication (TIPC) protocol is designed for communication within computer clusters. If the system is not part of a cluster that requires this protocol, the associated kernel module ('tipc') should be disabled. Leaving unused kernel modules enabled unnecessarily increases the kernel's attack surface, exposing the system to potential vulnerabilities within that module that could be exploited for privilege escalation or denial of service attacks.

Auditing and Remediation: The audit script confirms the module is both not currently running in memory (checked via `lsmod`) and configured to not load on-demand or at boot (checked via `modprobe`). The remediation script actively unloads the module and then creates a persistent configuration file to blacklist it, effectively disabling it.

Recommended State Rationale: 
- Basic: ['Disabled']. This is the fundamental security requirement. Disabling the module is the only compliant state for systems that do not explicitly require the TIPC protocol.
- Moderate: ['Disabled']. There is no intermediate state for this control. The security benefit is binary; the module is either enabled (posing a potential risk) or disabled (mitigating the risk). Therefore, the moderate recommendation is the same as the basic one.
- Strict: ['Disabled']. The strictest security posture is to ensure the module is disabled. Any configuration that allows the module to be loaded is considered a deviation from security best practices for a hardened system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'tipc' kernel module is disabled. The script should verify that the module is not currently loaded (via 'lsmod') and that it is prevented from loading by checking the output of 'modprobe -n -v tipc' for the 'install /bin/true' directive. The script must return only the string 'Disabled' if both conditions are met, or 'Enabled' otherwise, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument: the desired state ('Disabled'). If the argument is 'Disabled', the script must unload the 'tipc' module if it is currently loaded and create a modprobe configuration file to prevent it from being loaded in the future by adding the line 'install tipc /bin/true'. The script must return 'true' on success and 'false' on failure.

